I was asked
to get an SSL certificate for an "Oracle Application
Server 11g" which has a soon-to-expire certificate. Brushing aside the fact that 10g seems
to be the newest version, I got a certificate from InCommon, as I usually do without problem (except this is the first time I supplied Oracle Application
Server 11g as the software type on the CSR form). On the email containing links
to download the certificate, it mentioned:
Certificate Details:
SSL Type : InCommon SSL
Server : OTHER
I forwarded the email over
to the person responsible for installing it and got a reply that the
server type must be Oracle Application
Server for the certificate
to work (the CN is the same as before). They were unable
to install this certificate (no details provided
to me) and mentioned they had this issue previously with Thawte when they didn't supply Oracle Application
Server as the
server type. I don't see any significant difference between the currently installed certificate (working) and the new one I just got signed by InCommon (not working).
$ openssl x509 -in sso-current.cer -text
shows, with irrelevant information ommitted.
Data:
Version: 3 (0x2)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium
Server CA/
[email protected]
Validity
Not Before: Oct 1 00:00:00 2009 GMT
Not After : Nov 28 23:59:59 2012 GMT
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.thawte.com/ThawteServerPremiumCA.crl
X509v3 Extended Key Usage:
TLS Web
Server Authentication, TLS Web
Client Authentication
Authority Information Access:
OCSP - URI:http://ocsp.thawte.com
Signature Algorithm: sha1WithRSAEncryption
and
$ openssl x509 -in sso-new.cer -text
shows
Data:
Version: 3 (0x2)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, O=Internet2, OU=InCommon, CN=InCommon
Server CA
Validity
Not Before: Nov 8 00:00:00 2012 GMT
Not After : Nov 8 23:59:59 2014 GMT
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:48:4F:5A:FA:2F:4A:9A:5E:E0:50:F3:6B:7B:55:A5:DE:F5:BE:34:5D
X509v3 Subject Key Identifier:
18:8D:F6:F5:87:4D:C4:08:7B:2B:3F:02:A1:C7:AC:6D:A7:90:93:02
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web
Server Authentication, TLS Web
Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.5923.1.4.3.1.1
CPS: https://www.incommon.org/cert/repository/cps_ssl.pdf
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.incommon.org/InCommonServerCA.crl
Authority Information Access:
CA Issuers - URI:http://cert.incommon.org/InCommonServerCA.crt
OCSP - URI:http://ocsp.incommon.org
Nothing jumps out at me as the reason one would not work so I don't have a specific request for the signer for what
to do differently when re-signing.
