The recreated file is quite a bit smaller than the original NS one, why?
A. For some reason the encoding used by NS is not very efficient. The encoding used by my patch is somewhat better (actually its the indefinite length encoding in OpenSSL). Q. I’m having real problems getting a certificate into Netscape, help! A. OK here is a step by step guide on how to do things. 1. Create a CA. E.g. use CA.sh -newca. 2. If you are using OpenSSL 0.9.2 or later, and your configuration file adds the correct extensions (the default configuration file does), then skip to step 4, otherwise get and compile the ca-fix program if you don’t have it already. 3. Patch the CA certificate with: ca-fix -in demoCA/cacert.pem -inkey demoCA/private/cakey.pem -caset -out newca.pem This allows the CA to be used for signing SSL Client and S/MIME certificates. If you want to use the CA for object signing only then include the -nscertype 1 option, to support object signing as well as S/MIME and SSL Client use -nscertype 7. For more information on the -nscertype option see the ca-fix docum
