<anonymous@discussions.microsoft.com> wrote in message
news:1c1cf01c451d7$3416e270$a001280a@phx.gbl...
> Thank you much for your reply.
> Well, it does not depend upon the way (CA or makecert)
> that someone must validate the certificate as trusted if
> this is needed.
> This is not an issue for me, I would need certificates for
> encrypting emails between a limited number of persons
> which I personally know. I could hand over a diskette with
> the certificate, so distribution is not an issue, either.
> The problem is: are the certificates per se secure, or is
> the number of certificates created by makecert limited?
> (I am a patent attorney. Certificates of a trusted
> certification authority don't work for me because such
> certificates are bound to a single person. This would
> imply that I had to decrypt all emails by myself, which
> would be similar to the hypothesis that I had to open all
> envelopes of snail mail by myself. If I am not in the
> office, nobody can read the emails. Well, I could obtain a
> certificate for a secretary, but if she or he is not in
> the office, once again nobody can read the emails.)
>
> Martin M
>
> >-----Original Message-----
> >Well, if you had a CA, you would just use the CA to
> generate the certs, and
> >you wouldn't need makecert. If you didn't have a CA, you
> would get one from
> >someone with a CA, and again they wouldn't use makecert.
> >
> >I would define not having a CA as a technical reason and
> not a legal reason.
> >CA is free with Windows 2000 server. The requirement for
> CA is not because
> >of Microsoft licensing, but because you need someone
> somewhere to validate
> >the cert as trusted.
> >
> >With makecert, there is no built-in way to store or
> securely exchange the
> >secret components of the cert between the host server and
> the CA while
> >generating it, which theoretically compromises the
> security of the cert.
> >The CA handles this, certificate expiration, etc. No
> single utility like
> >makecert can do all these things that are necessary to
> make a reasonably
> >secure cert.
> >
> >
> >"Martin M" <martin.m14@aon.at> wrote in message
> >news:1c03b01c4518a$4087b9f0$a001280a@phx.gbl...
> >> I wonder why microsoft states that makecert creates only
> >> test certificates. Is this just for legal reasons (i.e.
> >> because I am not a trusted CA) or is this for technical
> >> reasons?
> >> As I understand a certificate needs a number which is
> the
> >> product of two very large primes (about 100 digits). It
> is
> >> most important that the primes are randomly selected: If
> >> the primes are randomly selected, it is (more or less)
> >> impossible to find the primes if only the product (which
> >> is part of the public key) is known.
> >> If makecert would use e.g. a table of only 1000 primes,
> >> this would be more than sufficient for testing, but
> would
> >> not give any security because everybody could try these
> >> 1000 primes and crack the certificate.
> >
> >
> >.
> >

>-----Original Message-----
>You do not have CA, you are one. You have a somewhat
trusted root
>certificate. You still need a program to generate
certificates (signed by
>your root certificate), you just wouldn't use makecert
(it can only create
>root certificates and it can't be really customized, you
can't set all the
>various options such as key usage).
>
>Jerry
>
>"Karl Levinson [x y] mvp" <levinson_k@despammed.com>
wrote in message
>news:ucQKZRZUEHA.2028@TK2MSFTNGP11.phx.gbl...
>> Well, if you had a CA, you would just use the CA to
generate the certs,
>> and
>> you wouldn't need makecert. If you didn't have a CA,
you would get one
>> from
>> someone with a CA, and again they wouldn't use makecert.
>>
>> I would define not having a CA as a technical reason
and not a legal
>> reason.
>> CA is free with Windows 2000 server. The requirement
for CA is not
>> because
>> of Microsoft licensing, but because you need someone
somewhere to validate
>> the cert as trusted.
>>
>> With makecert, there is no built-in way to store or
securely exchange the
>> secret components of the cert between the host server
and the CA while
>> generating it, which theoretically compromises the
security of the cert.
>> The CA handles this, certificate expiration, etc. No
single utility like
>> makecert can do all these things that are necessary to
make a reasonably
>> secure cert.
>>
>>
>> "Martin M" <martin.m14@aon.at> wrote in message
>> news:1c03b01c4518a$4087b9f0$a001280a@phx.gbl...
>>> I wonder why microsoft states that makecert creates
only
>>> test certificates. Is this just for legal reasons (i.e.
>>> because I am not a trusted CA) or is this for technical
>>> reasons?
>>> As I understand a certificate needs a number which is
the
>>> product of two very large primes (about 100 digits).
It is
>>> most important that the primes are randomly selected:
If
>>> the primes are randomly selected, it is (more or less)
>>> impossible to find the primes if only the product
(which
>>> is part of the public key) is known.
>>> If makecert would use e.g. a table of only 1000 primes,
>>> this would be more than sufficient for testing, but
would
>>> not give any security because everybody could try these
>>> 1000 primes and crack the certificate.
>>
>>
>
>
>.