[Help-gnutls] Re: Key usage violation in certificate
Roland.Winkler at physik.uni-erlangen.de
Mon Jun 1 17:46:37 CEST 2009
On Mon Jun 1 2009 Simon Josefsson wrote:
> Yes. They can chose between:
> 1) Disable DHE ciphersuite, because their certificate doesn't permit
> 2) Re-generate the certificate and add the sign key usage, which allows
> use of the certificate together with DHE.
> > Is it a part of the communication protocol between server and client
> > that the server should tell the client the allowed usage of its
> > certificate? I mean, the server knows the allowed usage of its
> > certificate. So I would guess that in an ideal world (that we don't
> > have...) no extra configuration of the server was necessary.
> Right. The server software could also detect that the certificate does
> not support signing, and then disable all DHE/EXPORT ciphersuites.
Thanks for the clarifications!
More information about the Gnutls-help