I'm trying to implement Mutual Certificate Authentication , I have to be the CA and server at the same time , generate certificates and sign them for users. and I'm following this tutorial which is a very simple one comparing to the complicated articles on the web , steps are :
The process for creating your own certificate authority is pretty straight forward:
- Create a private key
- Self-sign
- Install root CA on your various workstations // ????
Once you do that, every device that you manage via HTTPS just needs to have its own certificate created with the following steps:
- Create CSR for device
- Sign CSR with root CA key /// THIS STEP
Create the Root Key :
openssl genrsa -out rootCA.key 2048
self-sign this certificate.
openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem
Create A Certificate (Done Once Per Device) :
openssl genrsa -out device.key 2048
openssl req -new -key device.key -out device.csr
openssl x509 -req -in device.csr -CA root.pem -CAkey root.key -CAcreateserial -out device.crt -days 500
The last command is giving me this error :
Signature ok
subject=/C=XX/L=Default City/O=Default Company Ltd/CN=192.168.1.108
Error opening CA Certificate root.pem
3078969068:error:02001002:system library:fopen:No such file or directory:bss_file.c:355:fopen('root.pem','r')
3078969068:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:357:
unable to load certificate
The root.pem exists in the same folder why is it not being seen ?
Also, the first two commands gave me two files, root.key
and root.pem
:
there's no crt
file to give to browser .
What's wrong?
openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem ... openssl x509 -req -in device.csr -CA root.pem -CAkey root.key -CAcreateserial -out device.crt -days 500
Is your certificateroot.pem
orrootCA.pem
?