Goodness, well, that was painful. Hours gone!
As Thunderbird says, it is trusting that CA to vouch for SSL certs... ONLY SSL certs!
There are options in openssl.cnf for "keyUsage" and "extendedKeyUsage". But I wasn't able to get these to be recognized in /etc/ssl/openssl.cnf.
Using openssl x509 -in mykey.crt -text
I was not able to verify if this setting was doing anything.
The trick is to make a local one, called basic.cnf:
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
prompt = no
[ req_distinguished_name ]
C = {Country}
ST = {Provice/State}
L = {City}
O = {Org}
OU = {Org Unit}
CN = [email protected]
emailAddress = [email protected]
Probably can be even more stripped down that that. Apparently the default one packaged with Ubuntu 14.04 is limiting the uses of the key. Because with this, I can use my usual incantations to make keys and certificates, but with a new -config option to point to that stripped down config file:
KEYNAME=test_key
openssl genrsa -des3 -out ${KEYNAME}_private.pem 1024 -config basic.cnf
openssl req -new -key ${KEYNAME}_private.pem -out ${KEYNAME}.csr
openssl x509 -req -days 3650 -in ${KEYNAME}.csr -signkey ${KEYNAME}_private.pem -out ${KEYNAME}.crt
openssl pkcs12 -export -inkey ${KEYNAME}_private.pem -in ${KEYNAME}.crt -out ${KEYNAME}.p12
Then, importing the .crt into Thunderbird, I see this now:
And everything's happy again (after importing the new keys, etc.)