I'm following this instruction to install self-signed certificate. Specifically:

create localhost.conf file with the following content:

default_bits       = 2048
default_keyfile    = localhost.key
distinguished_name = req_distinguished_name
req_extensions     = req_ext
x509_extensions    = v3_ca

commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_default          = localhost
commonName_max              = 64

subjectAltName = @alt_names

subjectAltName = @alt_names
basicConstraints = critical, CA:false
keyUsage = keyCertSign, cRLSign, digitalSignature,keyEncipherment

DNS.1   = localhost
DNS.2   =


$ lsb_release -d
Description:    Debian GNU/Linux 11 (bullseye)
$ openssl version
OpenSSL 1.1.1k  25 Mar 2021
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out localhost.crt -config localhost.conf -subj '/CN=localhost'
Generating a RSA private key
writing new private key to 'localhost.key'
$ openssl pkcs12 -export -out localhost.pfx -inkey localhost.key -in localhost.crt
Enter Export Password: (empty password)
Verifying - Enter Export Password: (empty password)
$ sudo cp localhost.crt /usr/local/share/ca-certificates
$ sudo update-ca-certificates
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...

Adding debian:localhost.pem
$ openssl verify localhost.crt
CN = localhost
error 18 at 0 depth lookup: self signed certificate
error localhost.crt: verification failed

I suppose the latest command should verify the certificate successfully as it should be installed into the CA keys (i.e. trusted), but it does not. Am I missing something obvious here?

  • You may need to re-trace your steps. I've copied the above verbatim on a Debian 11 box and got localhost.crt: OK at the last step, which is what you would expect. Oct 14 at 5:45
  • My box was upgraded from Debian 10. Will try to reinstall it. Thanks! Oct 14 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.