CentOS - Jul 2008 - self Certificate Authority, using /etc/pki/tls/misc/CA

Hello all,

lately i am facing problems with Certification Authorities.
I have used centos script /etc/pki/tls/misc/CA my own certificate authority.
In next steps i am generating requests for certificates to services such as
LDAP,NNRPD and lately signing requests with CA. My approach is to import my
own CA into Windows Vista OS as root CA and trusted, to avoid messages in
clients such as "certificate could not be verified, certificate is not
signed or cerficate authority cannot be verified".

When i asked for help at openssl mailinglist i have recieved interesting
answer :

Just make sure your certificate is actually one "son" of your
CA.
>
> It is right To make one CA cert with the 509 extensions set to CA
>    X509v3 Basic Constraints:
>                CA:TRUE
>            X509v3 Key Usage:
>                Certificate Sign, CRL Sign
>            Netscape Cert Type:
>                SSL CA, S/MIME CA
>
> But it is a mistake to make the "son" as ANOTHER SELF SIGNED cert
with
> those
> extensions not set as CA
>     X509v3 extensions:
>            X509v3 Basic Constraints:
>                CA:FALSE
>            Netscape Cert Type:
>                SSL Client, SSL Server, S/MIME, Object Signing
>            X509v3 Key Usage:
>                Digital Signature, Non Repudiation, Key Encipherment
>            Netscape Comment:
>
> I know of important companies doing this mistake.
> The second cert has to be one SIGNED by the first CA authority, not a
> selfsigned one with CA fields "off" of false.
> Said in other words: the second cert is the result or output of a CSR
> (certificate signing request) signed by the CA cert.

Yes, that is true, so why this is not so in case of  /etc/pki/tls/misc/CA .
All my generated server certificates signed with own CA, using this script
have :

X509v3 extensions:
>             X509v3 Basic Constraints:
>                 CA:FALSE
>             Netscape Comment:
>                 OpenSSL Generated Certificate
>             X509v3 Subject Key Identifier:
>                 CC:FC:A1:2D:DE:CD:D1:9E:34:F3:89:08:F9:D6:30:79:AF:EE:6B:94
>             X509v3 Authority Key Identifier:
>
> keyid:C7:B9:B0:BC:5A:A2:73:18:02:F2:80:E2:8A:0C:BC:58:0C:87:14:95

Thanks in advance!

DAVID
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.centos.org/pipermail/centos/attachments/20080701/4ca080df/attachment-0002.html>