Generating certs for pkinit

Jeffrey Hutzelman jhutz at
Wed Nov 29 19:16:45 EST 2006

On Friday, November 24, 2006 04:37:23 PM -0500 Sam Hartman 
<hartmans at> wrote:

> People may find it a bit challenging to generate certificates for use
> with pkinit.  With the help of Olga I've included some openssl V3
> extensions configuration below.


I was expecting to have to write code for my (perl-based) CA tools to 
generate the entire SAN extension as a sequence of octets in order to issue 
certificates with id-pkinit-san names.  This is much better.

Thanks to you both.

-- Jeff

More information about the krbdev mailing list