1

I created root certificates, and server certificate, signed with root. How can I install my root certificate, to remove warning about untrusted connection? update, dpkg-reconfigure don't work. I'm using OpenSSL, Iceweasel browser, on Kali Linux v.1.1.0

EDIT

Steps: Creating secret key of root CA:

dd if=/dev/random of=.rnd count=64 bs=32
openssl genrsa -rand .rnd -out org.key 2048

Creating certificate request:

openssl req  -new -key org.key -config org.cnf -out org.csr

with:

org.cnf
[ req ] 
default_bits = 2048 
distinguished_name = req_distinguished_name 
extensions = v3_req 
x509_extensions = usr_cert 
[ req_distinguished_name ] 
countryName = US 
countryName_default = US 
stateOrProvinceName  = City
stateOrProvinceName_default = City
localityName = City
localityName_default = City 
organizationName = Company
organizationName_default = Company
organizationalUnitName = CA 
organizationalUnitName_default = CA 
commonName = CAuthority 
commonName_default = CAuthority 
emailAddress = master@ex.com
emailAddress_default = master@ex.com
[ v3_req ] 
basicConstraints = CA:TRUE 
nsComment = "CA certificate of PTI" 
nsCertType = sslCA 
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
basicConstraints=critical,CA:TRUE

Creating root CA:

openssl  x509 -req -signkey org.key -in org.csr -extfile org.cnf -out org.crt -days 1830

That's all for root, now I need to create server certificate, to install it on Apache. Creating secret key:

dd if=/dev/urandom of=.rnd count=64 bs=32;
openssl genrsa -rand .rnd -out httpd.key 2048; 

Creating certificate request:

openssl req  -new -key httpd.key -config httpd.cnf -out httpd.csr

with:

httpd.cnf
[ req ] 
default_bits = 2048 
distinguished_name = req_distinguished_name 
extensions = v3_req 
x509_extensions = usr_cert 
[ req_distinguished_name ] 
countryName = country [US] 
countryName_default = US 
stateOrProvinceName  = province [City] 
stateOrProvinceName_default = City 
localityName = locality [City] 
localityName_default = City
organizationName = organization [Company] 
organizationName_default = Company
organizationalUnitName = OU_name 
organizationalUnitName_default = Webserver 
commonName = commonName 
commonName_default = "localhost" 
emailAddress = email 
emailAddress_default = webmaster@ex.com
[ v3_req ] 
basicConstraints = CA:false 
nsComment = "Apache Server Certificate" 
nsCertType = server
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
basicConstraints=critical,CA:TRUE

After all, I sign httpd.csr with this command:

openssl ca -notext -in httpd.csr -cert org.crt -keyfile org.key -out httpd.crt -md sha1 -days 90 -verbose;

Then I install my httpd.crt and httpd.key to Apache, so, when I'm trying get https localhost, it says "Connection Untrusted". Adding httpd.crt to Authorities in Iceweasel, have no effect. Still "Untrusted Connection".

  • @garethTheRed I can add root certificate only to Authorities, I can't add it to My certificates, it asked password, but i created certificate without paswword. – Yurii N. Dec 27 '15 at 22:40
  • Hi @YuriyN., your question is not clear enough. You should try adding a better explanation of what you're trying to achieve and also include details about the commands you have tried so far. Please check the FAQ for how to ask good questions: meta.stackexchange.com/a/18588/160115 – forcefsck Dec 27 '15 at 23:43
  • @forcefsck I have my root.crt, root.key, root.cnf files, they represented my root certificate. I have server.pem, which signed by root.crt, it already installed on apache2, now I have "This Connection is Untrusted", when I'm trying to get https localhost in Iceweasel. So, the main question is, how to install the root certificate in Iceweasel, when I'm trying to import org.crt in Authorities, Iceweasel alerts me "This is not a certificate authority certificate, so it can't be imported into the certificate authority list.". That's the problem. I don't know what to do. – Yurii N. Dec 28 '15 at 0:02
  • @YuriyN., you should edit your question and add the relevant info there. Try to be more detailed, it would really help to include the commands you entered so far for creating your ca and server certs. Also, you mentioned that you used root.crt for signing your webserver's certificate, but then you tried to import org.crt? Shouldn't you try to import the root.crt? – forcefsck Dec 28 '15 at 1:16
0

You need to set CA:True as a basic extension on the root.crt.

The browser will not allow you to add a non-CA certificate to the Authorities list which is why you are getting the error message.

You can check whether this extension is in the certificate with:

openssl x509 -noout -text -in root.crt

This will print a textual representation of your certificate which you can search for the following extract:

X509v3 Basic Constraints: critical
    CA:TRUE

If it's not there, you'll need to modify your openssl config file and add the following to the block pointed to by x509_extensions:

basicConstraints = critical, CA:TRUE

man x509v3_config will give you all the details, but here's an example from the openssl.cnf file on a Fedora 23 box:

####################################################################
[ ca ]
default_ca  = CA_default        # The default ca section

####################################################################
[ CA_default ]

dir     = /etc/pki/CA       # Where everything is kept
certs       = $dir/certs        # Where the issued certs are kept
crl_dir     = $dir/crl      # Where the issued crl are kept
database    = $dir/index.txt    # database index file.
#unique_subject = no            # Set to 'no' to allow creation of
                    # several ctificates with same subject.
new_certs_dir   = $dir/newcerts     # default place for new certs.

certificate = $dir/cacert.pem   # The CA certificate
serial      = $dir/serial       # The current serial number
crlnumber   = $dir/crlnumber    # the current crl number
                    # must be commented out to leave a V1 CRL
crl     = $dir/crl.pem      # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE    = $dir/private/.rand    # private random number file

x509_extensions = usr_cert      # The extentions to add to the cert

You'll notice that x509_extensions points to a section further down in the file called usr_cert which has the following:

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

basicConstraints=CA:TRUE

Note that the name user_cert is simply that - a name, therefore the fact that your certificate is a CA certificate has no bearing. If you suffer from OCD, then you can change usr_cert to CA_cert in both.

The above should be added to the configuration file you are using. That is, if you are not adding the -config option to the openssl command then it will use the distro's default config file. This is usually in the OpenSSL's default directory which can be found with:

openssl version -d
  • if I don't have block pointed by x509_extensions, should I do something like this in /etc/ssl/openssl.conf: [ x509_extensions ] basicConstraints = critical, CA:TRUE and add it somewhere in file? Also, should I add this block to org.cnf? – Yurii N. Dec 28 '15 at 14:03
  • Added an example. What is org.cnf and where does that come into things? – garethTheRed Dec 28 '15 at 19:05
  • org.cnf i used in this command openssl req -new -key org.key -config org.cnf -out org.csr. – Yurii N. Dec 28 '15 at 19:46
  • Then add the suggested changes to org.cnf; not the system wide openssl.cnf file. – garethTheRed Dec 28 '15 at 20:38
  • Added steps of my solution. – Yurii N. Dec 29 '15 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.