How-To Geek

Hello

Software: SafeNet Authentication Client 8.1 SP1
Distribution: Ubuntu 12.04
Product: Aladdin eToken PRO

Problem: Unable to use certificate for digital stamping

What i've tried to do:

1) Modified OpenSSL conf file:

[ v3_req ]
# Extensions to add to a certificate request
keyUsage = digitalSignature

2) Used OpenSSL to generate certificate request
- openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key;

3) Generated self-signed certificate;

4) Converted .Key and .CRT to .p12;

5) Imported .p12 to eToken;

Everything does seem to be working well but since Safenet Authentication Client says that certificate usage is AT_KEYEXCHANGE (although key usage is digital signature and certificate key usage nonrepudiation), then i am not able to use my eToken for digital stamping.

Is there any option to:

1) Generate .CSR and same time load private key straight to eToken;
2) Generate .CRT of .CSR;
3) Use eToken for it's purpose;

Help is really appreciated.

I think you need to refer to the manufacturer, this device is unknown here.

http://uk.safenet-inc.com/prod.....token-pro/

http://uk.safenet-inc.com/technical-support/

Mike

You say you modified the OpenSSL conf file.

Have you gone back to default and then start again.

Another option is to return to vendor.

As I said above, this device is unknown to us therefore any config information is useless.

Mike

Thank you for reply, Mike.

Okay, but if we do forget about the product and concentrate on openssl.

This .CSR (made with utility) worked fine:

and this does not work:

Yes, it is. One request was made in browser by local certificate authority csr generator and 2nd was made by openssl.

Subject field data (Certificate data) is not important. Private key data is important and i must be doing something wrong or there's something wrong in openssl conf.

*ill google a bit more, though tried everything*

ah forget it. i would be thankful if you removed my thread.

pkcs11-tool --module /usr/lib/libeTPkcs11.so -k --key-type rsa:2408 -l --id 45 --label NEW

works fine.