RE: Emaill address in a certificate - NEW

Alon:

The certificate building logic in the SFL is for test purposes only, there
are a number of limiting assumptions when we build DNs, etc. (e.g. All DN
components are PrintableString) so I would suggest you not use these
utilities for any commercial endeavor.

For test purposes, you can add any extension not recognised by the test
logic DNs as a simple OID.  I am not sure what OID the "E" stands for, but
you could simply add the OID instead, it will be encoded and displayed
properly.  An example of this technique is presented in the test config file
"./test/certs/config.d/DaisyRsaExts.cfg".  I can send you this config file
if you are interested.

Login=C=US@O=US Government@OU=VDA Site@OU=VDA@CN=Daisy RSA
[email protected][email protected]

If you wish to implement the suggestion made by Rich about the "Subject
Alternative Name extension"; our test logic does not support the extension,
you will have to add logic to "sm_CfgCert.cpp" and some keywords to the
config file (or simply hardcode the answer and OID for the extension).

Bob Colestock, VDA.

-----Original Message-----
From: Alon Barak [mailto:[email protected]]
Sent: Thursday, May 25, 2000 7:32 AM
To: '[email protected]'
Cc: Zvi Agmon
Subject: Emaill address in a certificate - NEW


Hello
First, I'm sorry the first mail was sent.
I'm trying to create a certificate using the SFL v1.5 in C++ application on
winNT os.
I created a DSA certificate using the 'auto_hi' tests project without an
eMail address in it, but I failed creating a certificate that has an eMail
address in it.
Using the CML v1.6 I viewed at a certificate issued by VeriSign and the
eMail address was part of the subject DN,
and there was no SubjectAltName extension.
When I tried to create a new DSA certificate with an eMail address in the
subject DN
'[email protected]@C=US@O=US Government@OU=VDA
Site@OU=VDA@CN=Alon Barak DSA'
or
'[email protected]@C=US@O=US Government@OU=VDA
Site@OU=VDA@CN=Alon Barak DSA'
but it failed since the SFL did not recognize the 'E' or 'emailaddress'
prefix.
so...
1. Who can I add the eMail address to the DN and to the extensions ?
2. What is the right way add the eMail address to a certificate that will be
recognize by the common mailers as a valid certificate,
   is the way that VeriSign does it in the DN, or in the extensions ?
3. Do you have a C/C++ api for creating a public/private key pair ?

Thank in addvance 
(and sorry about the first mail)
Alon Barak
Vanguard Security Technologies Ltd.
Tel: 972-4-9891311 (Ext. 221); 
Fax: 972-4-9891322
mailto:[email protected]