I created a certificate authority in Ubuntu using this command:

openssl req -config /etc/ssl/openssl.cnf -new -x509 -keyout ck.pem -out cacert.pem -days 365

Then I created a certificate request using:

openssl req -out C.csr -new -newkey rsa:2048 -nodes -keyout c_p.key

I would like to sign this request using the certificate authority I created. For that I executed:

openssl ca -config /etc/ssl/openssl.cnf -policy optional -out C.crt -infiles C.csr

But I get the error:

Using configuration from /etc/ssl/openssl.cnf unable to load CA
private key 140189274035872:error:0906D06C:PEM
routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY

How can I get rid of this error? Will this command use the authority I defined above or maybe some default authority in the system?


For completeness I leave the steps that I had to do:

  1. Create the relevant files:
mkdir demoCA
mkdir ./demoCA/newcerts
touch ./demoCA/index.txt

Also create a "serial" file in demoCA that contains 01 and a newline at the end.

  1. Certify:
openssl ca -config /etc/ssl/openssl.cnf -cert cacert.pem -keyfile ck.pem -out C.crt -infiles C.csr

You've created a new key pair with the first command. You now need to tell the OpenSSL CA about these.

Either edit /etc/ssl/openssl.cnf and ensure that the private_key and certificate lines point to the new private key and certificate file locations, or use the -cert and -keyfile arguments to the openssl ca command to override the values in /etc/ssl/openssl.cnf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.