1

I'm aware that sites like StartSSL use Client-Certificates, I opened mine in Firefox and it showed me: "SSL-Client-Certificate", "E-Mail-Receiver-Certificate", "E-Mail-Signer-Certificate".

Now I'm asking myself, for self-signed certificates, is it possible to restrict usage of X.509(v3?) certificates to be only TLS-Client? (-> no server / no S/MIME)

Improve this question

1 Answer 1

Reset to default
1

Yes, it is possible for X.509 to be only "TLS client" (actually to have the extended key usage only set to client). I suggest you to take a look at XCA, it is free a graphical tool which will allow to easily create and manage certificates (it is actually a small PKI).

You will then be able to visually see all the main options a certificate can have, which one fits in the client or server template profiles, and play with these options.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .