Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to implement Mutual Certificate Authentication , I have to be the CA and server at the same time , generate certificates and sign them for users. and I'm following this tutorial which is a very simple one comparing to the complicated articles on the web , steps are :

  • The process for creating your own certificate authority is pretty straight forward:

    1. Create a private key
    2. Self-sign
    3. Install root CA on your various workstations // ????
  • Once you do that, every device that you manage via HTTPS just needs to have its own certificate created with the following steps:

    1. Create CSR for device
    2. Sign CSR with root CA key /// THIS STEP

Create the Root Key :

openssl genrsa -out rootCA.key 2048

self-sign this certificate.

openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem

Create A Certificate (Done Once Per Device) :

openssl genrsa -out device.key 2048
openssl req -new -key device.key -out device.csr
openssl x509 -req -in device.csr -CA root.pem -CAkey root.key -CAcreateserial -out device.crt -days 500

The last command is giving me this error :

Signature ok
subject=/C=XX/L=Default City/O=Default Company Ltd/CN=
Error opening CA Certificate root.pem
3078969068:error:02001002:system library:fopen:No such file or directory:bss_file.c:355:fopen('root.pem','r')
3078969068:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:357:
unable to load certificate

The root.pem exists in the same folder why is it not being seen ?

Also, the first two commands gave me two files, root.key and root.pem: there's no crt file to give to browser .

What's wrong?

share|improve this question
openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem ... openssl x509 -req -in device.csr -CA root.pem -CAkey root.key -CAcreateserial -out device.crt -days 500 Is your certificate root.pem or rootCA.pem? – lgeorget Apr 26 '13 at 22:52
yes , you are right , i was copying from the page . :$ I got the device.crt now , import it to firefox , but when asking for ip of the server with https , it gave me that page woth yellow sign "Untrusted Connection" !! – Nancy Smith Apr 26 '13 at 23:12
up vote 1 down vote accepted

Verify the name of your certificate. It's inconsistent (root.pem in a command, rootCA.pem in another).

You can install the root.pem file on your client hosts as indicated in the article, it's your CA certificate. PEM is a format for certificate, others exist. .crt is a generic extension. You can rename your certificate from root.pem to root.crt if you want to.

share|improve this answer
so I have to give the browser the root.pem (after renaming it root.crt because it doesn't accept such suffix) and give it the device.crt too ??? – Nancy Smith Apr 26 '13 at 23:15
I've added root certificate to the root but didn't help , and the I don't know where to add device.crt !!! – Nancy Smith Apr 26 '13 at 23:34
@Igeorget plz just tell me where to add device.crt , this step is left . – Nancy Smith Apr 26 '13 at 23:43
The device.crt file is the certificate your server will check to verify that the device is actually an authorized device. It will be sent by the client to the server at the beginning of the connection. What kind of application do you need a client authentication for? If it is for web, you have to put your certificate in the list of certificates authenticating yourself. For example, in firefox, in the certificate view, there is a tab your certificates. What clientside application do you use? – lgeorget Apr 27 '13 at 1:25
thanks , I'm using firefox as a clientside and apache as web server – Nancy Smith Apr 27 '13 at 19:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.