Java
  GuestBook
  Security
     Explorer
     Netscape

JavaScript
  Mouse Over

Layers
  Menu

Windows
  File Types

Do It Yourself

So you want to torture yourself eh? Read on brave warrior...

Okay, so it's supposed to be an open standard. Shouldn't I be able to create my own certificate for use inside my intranet and go from there?

Well the first question people in the US must ask yourself is: Is this for commericial purposes? Even if you are just doing it for an intranet, that's commerical. RSA holds the patent for public key cryptography, and so until the year 2000 then even if you wrote the code yourself, you couldn't use it.

Now given that you are not in the US or you are an education institution (with written permission to use RSAREF) then here are a few steps to get you on your way.

First our goal: To create a certificate that can be used to sign an applet so that netscape 4.0 will be able to recognise it. We want to do this without paying.

Now let me note that I didn't actually fill in all the blanks neccessary to create an object signing certificate from scratch. This is mostly because I ran out of time. But this should be enough information to get you on your way.

Requirements for a certificate used to sign applets.

  • Signed by a recognised Certifying Authority certificate.
  • Is an object signing certificate.
  • Is a valid certificate (obviously)

Signed by a certifying authority certificate

So we need to create one of these.

Short Version

  1. build apache with SSL extensions
  2. cd apache/src
  3. configure apache conf files (don't forget to configure SSLconf stuff)
  4. make certificate
  5. start server.
  6. connect to server.

Long version 

    Download apache
    http://www.apache.org/
download SSLeay
    ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/
      eg SSLeay-0.8.1.tar.gz
get extentions for Apache-SSL
    http://www.algroup.co.uk/Apache-SSL/
    ftp://ftp.ox.ac.uk/pub/crypto/SSL/
	apache_1.2.4+ssl_1.11.tar.gz
Follow directions contained in README located in the above file.
    with the following exceptions:

    Part of the instructions are apply a patch. If you are on Solaris (and maybe some other systems), you will need gnu "patch" (ftp://prep.ai.mit.edu/pub/gnu/patchx.y.tar.gz) 

    it says:
	patch < SSLpatch
but you really need:
	patch -p0 < SSLpatch
the continue with the build.
    This will get you apache-ssl. (server will be httpsd rather than httpd)

    Before you start the server, you will need a server certificate: This can be generated using: 

    cd /src
make certificate
    Provide the information they ask for (company, location, email etc). For netscape the *common* name should be *.mydomain.com or the name of the server (where mydomain is really you domain!) This will eliminate the user from needing to see some warning message about the possibility of a bogus certificate (but it'll still work anyway).

    You must also make sure that bit's 3 and 7 are turned on for the netscape-cert-type exentions (or is that nsCertType?) to ensure that the certificate is able to sign objects (so really you would just need bit 7 Object Signing CA). Bit 3 says it's an object signing certificate.

So at this point you would have a certificate (httpsd.pem) that is a valid Object Signing CA. (in SSLconf/conf)

you can load this certificate into the browser by copying this to your web server so that it will have the type application/x-x509-ca-cert (I added the following lines to mime.types, copied httpsd.pem to file.cx and restarted the server: 

application/x-x509-user-cert    ux
application/x-x509-ca-cert      cx
application/x-x509-email-cert   ex
)

To go further you need to start writting some code... Now you need to import the certificate into netscape. One way to do this is to use the <KEYGEN> interface described in Communicator 4.0 Key Generation. You also need to read the Certificate Download Spec Mon Oct 13 04:50:06 EDT 1997

I figured out how to get communicator to generate a key. Check this out. Here is the html to do that. This step is neccessary to get communicator to accept a user certificate. Otherwise an error something like, the corresponding private key does not exist in the database, will result. Which really makes a lot of sense, since you don't want Verisign (et al) to know your private key, kinda cool eh?

Import a certificate into netscape from scratch!

Now you are on the edge.

The following are hints towards making an object signing certificate for yourself. There is not enough information, but if you are adventurous, it'll head you down a path (hopefully the right one!)