gpgsm --import of CA certificate: Bad signature?


gpgsm --import of CA certificate: Bad signature?
\ Simon Josefsson (17 Apr 2007)
. \ Werner Koch (17 Apr 2007)
. . \ Werner Koch (18 Apr 2007)
. \ Simon Josefsson (18 Apr 2007)
. . \ Werner Koch (18 Apr 2007)
. . . \ Simon Josefsson (18 Apr 2007)
. . . . \ Werner Koch (18 Apr 2007)
. . . . . \ Simon Josefsson (18 Apr 2007)

11 msg	Lost passphrase
2 msg	keyserver-options auto-key-retrieve
5 msg	The Polish language in gnupg.spec is horrible
10 msg	commands for gpg keychain access
8 msg	Batch Mode and decrypt
11 msg	personal-digest-preferences
4 msg	Check integrity of gnupg-w32cli-1.4.7.exe
11 msg	Key Revocation
2 msg	Original File Names
2 msg	How to protect private keys
6 msg	How to protect private keys?
1 msg	Re: comment and version fields // doesn't need ...
5 msg	Decrypting multiple files gives errors
1 msg	Problem when decrypting multiple files
3 msg	PowerPC
36 msg	Gnupg cannot handle extremely large keys on 32 ...
1 msg	Using multiple subkeys in GPG
3 msg	Using GNUPG with php scripts and webserver
7 msg	Un-revoking a key pair

Subject:	gpgsm --import of CA certificate: Bad signature?
Group:	Gnupg-users
From:	Simon Josefsson
Date:	17 Apr 2007

Hi! I'm trying to get Scute working in Mozilla (as a first step
towards making GnuTLS also use it as a PKCS#11 module). I imported my
newly generated certificate into gpgsm as follows:

jas@mocca:~$ gpgsm --import .gnupg/test-key.pem
gpgsm: issuer certificate {E93C1CFBAD926EE606A4562CA2E1C05327C8F295} not found using authorityKeyIdentifier
gpgsm: issuer certificate (#/CN=GnuTLS test CA) not found
gpgsm: issuer certificate {E93C1CFBAD926EE606A4562CA2E1C05327C8F295} not found using authorityKeyIdentifier
gpgsm: total number processed: 1
gpgsm: unchanged: 1
jas@mocca:~$

I guessed that it wouldn't hurt to import the CA certificate too. But
here's what happened then:

jas@mocca:~$ gpgsm --import ~/src/www-gnutls/test-credentials/x509-ca.pem
gpgsm: self-signed certificate has a BAD signature: Bad signature
gpgsm: basic certificate checks failed - not imported
gpgsm: total number processed: 1
gpgsm: not imported: 1
jas@mocca:~$

As far as I can tell, there is nothing wrong with this certificate.
Ideas?

You can retrieve the certificate from:
http://www.gnu.org/software/gnutls/test-credentials/x509-ca.pem

I'm using GnuPG 2.0.3.

I don't know if it is relevant, but the list of 'Supported algorithms'
seems rather short:

jas@mocca:~$ gpgsm --version
gpgsm (GnuPG) 2.0.3
Copyright (C) 2007 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

Home: ~/.gnupg
Supported algorithms:
jas@mocca:~$

/Simon

_______________________________________________
Gnupg-users mailing list
Gnupg-users
http://lists.gnupg.org/mailman/listinfo/gnupg-users