Re: storing a certificate chain in a key store

Abhijit Menon-Sen <[email protected]> writes:

>I have three certificates in bundle.crt and one in server.crt; both are in
>text format, i.e. base64 wrapped in BEGIN CERTIFICATE/END CERTIFICATE lines.
>I put all four certificates into all.crt, read the file contents, and call
>cryptImportCert(). The result has a CRYPT_CERTINFO_CERTTYPE of
>CRYPT_CERTFORMAT_CERTIFICATE, not CRYPT_CERTFORMAT_CERTCHAIN.

If you put four separate encoded certificates into a single file in base64
format that you've got four distinct certs, not a certificate chain.  cryptlib
reads the first cert and then imports it, giving you a
CRYPT_CERTFORMAT_CERTIFICATE.

>Do I need to export the chain in some other format? (PKCS #7?) I tried
>"openssl crl2pkcs7 -nocrl -certfile bundle.crt -certfile server.crt -out
>all.p7" and using all.p7 in place of all.crt, but then cryptImportCert()
>fails with CRYPT_ERROR_BADDATA.

You need to export it as a PKCS #7 certificate chain.  What does dumpasn1 tell
you about the chain?

Peter.

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.