Subject: About Key Usages...

From: "Fabio Mazzocchi" <[email-masked]>
Date: Wed, 2 May 2001 12:37:13 +0200

Hi all,
I have a little question for you. I need to know if there is at least one combination of KeyUsage, Extended Key Usage, and Netscape CertType which let me use two certificate with Microsoft products as well as Netscape ones. I need a certificate to use with mail clients (Outlook and Messenger) and a certificate to work with browsers for SSL connections.
My idea was to generate the mail certificate with :

KU -> Digital Signature, Key Enciphrment
EKU -> EMail (1.3.6.1.5.5.7.3.4)
NetscapeExtension -> S/Mime

in the SSL certificate the extensions are :

KU -> Digital Signature
EKU -> EMail (1.3.6.1.5.5.7.3.2)
NetscapeExtension -> SSL Client Authentication

(none of the above extensions is critical)

With IE and Outlook, the certificates work fine, because Microsoft products mind just the EKU. With Netscape (4.76) and Messenger, I can just use SSL certificate.
How can I force the use of the mail certificate? Why Netscape doesn't mind the S/Mime extension?
Till now, the only solution I have found, is to force the usage of my mail certificate setting the KU extension as critical, but I don't think it is the best one. Have someone a best solution?

Thanks in advance.

Fabio.