Re: cosignd and multiple CAs

[Phil Pishioneri <pgp@xxxxxxx>]

On 6/4/04 12:11 PM, johanna bromberg craig wrote:

> We run it this way at Michigan now. :)
>
> We use Verisign, InstantSSL and our umwebCA all together in our 
> current weblogin infrastructure.
>
> Are you running into any issues with this sort of configuration?


While attempting to use a filter cert from the second CA, we're getting 
this on the cosignd's syslog:

f_starttls: snet_starttls: error:140890B2:SSL 
routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

(no other error messages being logged on the server).

At the filter's side, we aren't getting any error messages in the web 
server's error_log.

If we switch the cert the filter is using to one signed by the first CA 
(same one that signed the cosignd cert), it works.

The one significant difference between those certs (both CAs are local) 
is that the 1st has keys of 1024 bit lengths (for both CA and client), 
the 2nd is using 2048 lengths (for both).

-Phil