Hello,

after i have created a digital certificate (.p12 format) using OpenSSL and import the cert into MS outlook express,
when i clicked the signed/encrypt button and sent the mail,
it was not prompt to ask me to type the password(private key),
the purpose and the function of using signed mail is vanished...

i have made a search from Microsoft web site about how to make it prompt for the password before sending the signed/encrypted mail, i found the following messages:

"When you obtain a certificate (or digital ID) from a public certification authority (CA) such as VeriSign, you can request additional security to protect your private key (or digital ID). If you request additional security to protect your private key, you are prompted for a password when you send a digitally signed message. If you do not type your private key password but instead click Cancel, your private key is not used to digitally sign the message when it is sent, and the message is sent unsigned. "


anybody know how to generate the cert using OpenSSL so that it will prompt me to type the password?
or, how to set it in Outlook express or Netscape/mozilla??

Thanks a lot.

Are you sure that your gave your certificate a password during creation?

The following URL may help:
http://www.fz-juelich.de/zam/unicore...rtificates.htm

You mean given the password while creating the .p12 cert with
the "-password pass:MyUserPass" parameter??
yes, i haven't, can password be type in interactive mode instead of typing it inline?

Try it, it wont hurt. If not, you can always exit the shell, log back in and delete the specific command from ~/.bash_history .

But i need to generate certs for my colleagues, for internal use only.
For security issue, it is impossible to see the other's passphase.

And you can't let them create their own certs with their own passphrases because you dont want them to have access to your priv pem file? How many colleagues are we talking about?

Around 50+ peoples..
they don't know the password of the CA,
I will let them key in there private key while generating the cert request, and while generating the .p12 file,
i will ask them to type their key again, at the same time,
i hope them to key in the password for the certificate,
but no one should see the plain text of what they are typing, including me.

Maybe a little "expect" scripting could help, else you gotta type in your CA passwd +50 times...