We've been using makecert to generate certificates for testing, and in some environments, we have access to Active Directory Certificate Services, for which we have certificate templates we can use to create the various certificates our app needs, but we'd like to set up a batch file we can run to create all the certs required for a new installation in one go.

At the moment, I'm using openssl - and so far, things are going really well. I've hit a bit of a snag, though - one of our certificates is used for key exchange (in makecert, this would be -sky Exchange) ... and I can't seem to find an option for that in openssl. It has to be there, but I've been searching and searching through their documentation and I'm not finding it - I assume it's called something else..or something.


Edit: using the certificates as they came out of OpenSSL seemed to work fine, including the one used for key exchange, so I'm guessing the -sky Exchange parameter was something makecert-specific, but confirmation of that would be appreciated.

migrated from security.stackexchange.com Jan 12 '15 at 23:38

This question came from our site for information security professionals.

  • It's not clear to me (as MS doc often isn't) whether they simply mean a cert for a privatekey whose usage is restricted, or if they mean a cert with the KeyUsage extension in the cert, or both. Perhaps you should look at a good example cert (or several) to find out. If you do want KeyUsage (or most other extensions) in the cert, OpenSSL can do that, but the details depend on what value(s) you want and which OpenSSL method(s) you use; ask more specifically. – dave_thompson_085 Jan 17 '15 at 0:37
  • My main goal was to be able to encrypt with the public key and decrypt with the private key. When I used certificates from makecert without specifying -sky Exchange to encrypt with the public key in .NET code, I'd get "Key not valid for use in specified state," and I was looking for analogous options in openssl. ..But, as it turns out, the openssl certs seem to work fine. – William Scalf Jan 18 '15 at 2:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.