2

We've been using makecert to generate certificates for testing, and in some environments, we have access to Active Directory Certificate Services, for which we have certificate templates we can use to create the various certificates our app needs, but we'd like to set up a batch file we can run to create all the certs required for a new installation in one go.

At the moment, I'm using openssl - and so far, things are going really well. I've hit a bit of a snag, though - one of our certificates is used for key exchange (in makecert, this would be -sky Exchange) ... and I can't seem to find an option for that in openssl. It has to be there, but I've been searching and searching through their documentation and I'm not finding it - I assume it's called something else..or something.

Help?

Edit: using the certificates as they came out of OpenSSL seemed to work fine, including the one used for key exchange, so I'm guessing the -sky Exchange parameter was something makecert-specific, but confirmation of that would be appreciated.

2
  • It's not clear to me (as MS doc often isn't) whether they simply mean a cert for a privatekey whose usage is restricted, or if they mean a cert with the KeyUsage extension in the cert, or both. Perhaps you should look at a good example cert (or several) to find out. If you do want KeyUsage (or most other extensions) in the cert, OpenSSL can do that, but the details depend on what value(s) you want and which OpenSSL method(s) you use; ask more specifically. Jan 17, 2015 at 0:37
  • My main goal was to be able to encrypt with the public key and decrypt with the private key. When I used certificates from makecert without specifying -sky Exchange to encrypt with the public key in .NET code, I'd get "Key not valid for use in specified state," and I was looking for analogous options in openssl. ..But, as it turns out, the openssl certs seem to work fine. Jan 18, 2015 at 2:54

0

You must log in to answer this question.

Browse other questions tagged .