1

I have created my own X509 certificate with my own CA. I am able to import the CA certificate into Firefox, but when I try to import the user's certificates I get the following:

Could not verify this certificate for unknown reasons

I'm guessing I did something wrong while creating the certificates. Is there any way to get more information about why Firefox couldn't verify the certificates?

Improve this question
1

1 Answer 1

Reset to default
1

Make sure the certificate has "Digital Signature" enabled

Take a look at the key usage extensions on the certificate. They are labelled X509v3 Key Usage by OpenSSL.

$ openssl x509 -in mycert.pem -text -noout
...
X509v3 Key Usage: critical
    Digital Signature, Non Repudiation
X509v3 Extended Key Usage: 
    TLS Web Client Authentication, E-mail Protection

If the certificate can't be used for Digital Signature (e.g., it is for E-mail Protection only), then Firefox may not be able to use it.

NSS, the SSL library that Firefox and Mozilla products use, is much stricter than OpenSSL about the key usage settings.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.