Re: Client Auth certificates, threat or menace?

John Levine  wrote:

The claim, which I'm not sure I believe, is that the calls to openssl
have default values
that want the client flag.

Maybe you can give it a try? Or those who make the claim can show
the problem?

It seems to be real based on the openssl doc:

CERTIFICATE EXTENSIONS
       The -purpose option checks the certificate extensions and
       determines what the certificate can be used for. The actual
       checks done are rather complex and include various hacks and
       workarounds to handle broken certificates and software.
...
!      The extended key usage extension places additional restrictions
!      on the certificate uses. If this extension is present (whether
!      critical or not) the key can only be used for the purposes
!      specified.

       A complete description of each test is given below. The
       comments about basicConstraints and keyUsage and V1 certificates
       above apply to all CA certificates.

       SSL Client
   The extended key usage extension must be absent or include
   the "web client authentication" OID.  keyUsage must be
   absent or it must have the digitalSignature bit set.
   Netscape certificate type must be absent or it must have
   the SSL client bit set.

--
Note: please read the netiquette before posting. I will almost never
reply to top-postings which include a full copy of the previous
article(s) at the end because it's annoying, shows that the poster
is too lazy to trim his article, and it's wasting the time of all readers.