How to sign CSR with time stamp enabled

I got a time stamp server and need to renew its cert.
But after signing the CSR with my Win 2003 CA, I found that some features
like Enhanced Key Usage: Time Stamping (1.3.6.1.5.5.7.3.8) are missed.

I have searched the net and found some tricks to set extension before
signing. I did a trial but failed to do so.
Please advise.


echo 30 0A 06 08 2B 06 01 05 05 07 03 08>timestampoid.txt
certutil.exe -setextension 35 2.5.29.37 1 @timestampoid.txt

Thanks a lot!

Hi,

Maybe this could be helpful

http://technet.microsoft.com/en-us/l.../cc740063.aspx

Check out the part named "Allowing and Blocking Extensions in Certificate Requests".

HTH

Martin Rublik

Patrik wrote:
> I got a time stamp server and need to renew its cert.
> But after signing the CSR with my Win 2003 CA, I found that some features
> like Enhanced Key Usage: Time Stamping (1.3.6.1.5.5.7.3.8) are missed.
>
> I have searched the net and found some tricks to set extension before
> signing. I did a trial but failed to do so.
> Please advise.
>
>
> echo 30 0A 06 08 2B 06 01 05 05 07 03 08>timestampoid.txt
> certutil.exe -setextension 35 2.5.29.37 1 @timestampoid.txt
>
> Thanks a lot!
>
>