1

I'm trying to implement Mutual Certificate Authentication , I have to be the CA and server at the same time , generate certificates and sign them for users. and I'm following this tutorial which is a very simple one comparing to the complicated articles on the web , steps are :

  • The process for creating your own certificate authority is pretty straight forward:

    1. Create a private key
    2. Self-sign
    3. Install root CA on your various workstations // ????

  • Once you do that, every device that you manage via HTTPS just needs to have its own certificate created with the following steps:

    1. Create CSR for device
    2. Sign CSR with root CA key /// THIS STEP

Create the Root Key :

openssl genrsa -out rootCA.key 2048

self-sign this certificate.

openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem

Create A Certificate (Done Once Per Device) : 

openssl genrsa -out device.key 2048
openssl req -new -key device.key -out device.csr
openssl x509 -req -in device.csr -CA root.pem -CAkey root.key -CAcreateserial -out device.crt -days 500

The last command is giving me this error : 

Signature ok
subject=/C=XX/L=Default City/O=Default Company Ltd/CN=192.168.1.108
Error opening CA Certificate root.pem
3078969068:error:02001002:system library:fopen:No such file or directory:bss_file.c:355:fopen('root.pem','r')
3078969068:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:357:
unable to load certificate

The root.pem exists in the same folder why is it not being seen ?

Also, the first two commands gave me two files, root.key and root.pem: there's no crt file to give to browser .

What's wrong?

Improve this question
2
  • openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem ... openssl x509 -req -in device.csr -CA root.pem -CAkey root.key -CAcreateserial -out device.crt -days 500 Is your certificate root.pem or rootCA.pem?
    – lgeorget
    Apr 26, 2013 at 22:52
  • yes , you are right , i was copying from the page . :$ I got the device.crt now , import it to firefox , but when asking for ip of the server with https , it gave me that page woth yellow sign "Untrusted Connection" !!
    – Nancy Smith
    Apr 26, 2013 at 23:12

1 Answer 1

Reset to default
1

Verify the name of your certificate. It's inconsistent (root.pem in a command, rootCA.pem in another).

You can install the root.pem file on your client hosts as indicated in the article, it's your CA certificate. PEM is a format for certificate, others exist. .crt is a generic extension. You can rename your certificate from root.pem to root.crt if you want to.

Improve this answer
5
  • so I have to give the browser the root.pem (after renaming it root.crt because it doesn't accept such suffix) and give it the device.crt too ???
    – Nancy Smith
    Apr 26, 2013 at 23:15
  • I've added root certificate to the root but didn't help , and the I don't know where to add device.crt !!!
    – Nancy Smith
    Apr 26, 2013 at 23:34
  • @Igeorget plz just tell me where to add device.crt , this step is left .
    – Nancy Smith
    Apr 26, 2013 at 23:43
  • The device.crt file is the certificate your server will check to verify that the device is actually an authorized device. It will be sent by the client to the server at the beginning of the connection. What kind of application do you need a client authentication for? If it is for web, you have to put your certificate in the list of certificates authenticating yourself. For example, in firefox, in the certificate view, there is a tab your certificates. What clientside application do you use?
    – lgeorget
    Apr 27, 2013 at 1:25
  • thanks , I'm using firefox as a clientside and apache as web server
    – Nancy Smith
    Apr 27, 2013 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .