Invalid CA certificate with self-signed certificate chain


Tejas

I have a self signed certificate chain with these commands and configured it on the Apache server

but when i tryopenssl s_client -showcerts -servername server -connect my-host.local:443 -CAfile all.crt

I am getting error from opensslVerify return code: 24 (invalid CA certificate)

Is there a problem with the command or configuration file used to generate the certificate?

Command to create certificate chain

# self signed root cert
openssl genrsa -aes256 -out ca.key 4096
openssl req -new -x509 -days 3000 -key ca.key -out ca.crt -config ca.conf

# intermediate cert signed with the root cert
openssl genrsa -aes256 -out int.key 4096
openssl req -new -key int.key -out int.csr -config int.conf
openssl x509 -req -days 3000 -in int.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out int.crt

# leaf cert signed with the intermediate cert

openssl genrsa -aes256 -out leaf.key 4096
openssl req -new -key leaf.key -out leaf.csr -config leaf.conf
openssl x509 -req -days 3000 -in leaf.csr -CA int.crt -CAkey int.key -set_serial 01 -out leaf.crt

 cat ca.crt int.crt leaf.crt > all.crt

These are the config files I have used

ca.conf

[REQ]
distinguished_name=req_distinguished_name
x509_extensions=v3_ca
dirstring_type=nobmp
[req_distinguished_name]
COMMONNAME=common name (eg, your name)
commonName_default=root
[v3_ca]
keyUsage=key, keyCertSign
subjectKeyIdentifier=hash
implement authorityKeyIdentifier=KEYID:total yes, issuer: always
basicConstraints=critical, CA: true, path: 1
extendedKeyUsage=serverAuth

int.conf

[req]
杰出名称= req_distinguished_name
x509_extensions = ext
[req_distinguished_name]
commonName =通用名称(例如,您的名称)
commonName_default = int
[ext]
keyUsage = critical,keyCertSign
subjectKeyIdentifier = hash
AuthorityKeyIdentifier = keyid:always,
issues :always:trains ,pathlen:0
extendedKeyUsage = serverAuth

leaf.conf

[req]
distinguished name=req_distinguished_name
dirstring_type=nobmp
[req_distinguished_name]
commonName=common name (eg your name)
commonName_default=leaf

monotonous

The CA root certificate must be marked as belonging to the CA :

The CA certificate must contain the basicConstraints value with the CA field set to TRUE. The end user certificate must have CA set to FALSE or exclude the extension entirely. Some software may require the inclusion of basicConstraints with CA set to FALSE for end-entity certificates.

This is done by extending the base constraint criteria. To check if your root certificate has properties set , run and look in the output . Note that OpenSSL will actually allow you to sign other certificates with a non-CA root certificate (or at least used to) , but verification of such certificates will fail (as the CA check will fail).CAopenssl x509 -text -noout -in ca.crtCA:True

With your configuration file, just include -extensions v3_cain the command to generate the root certificate :

openssl req -new -x509 -extensions v3_ca -days 3000 -key ca.key -out ca.crt -config ca.conf -extfile ca.conf

Related


Invalid CA certificate with self-signed certificate chain

Tejas I have a self signed certificate chain with these commands and configured it on the Apache server but when i tryopenssl s_client -showcerts -servername server -connect my-host.local:443 -CAfile all.crt I am getting error from opensslVerify return code: 2

Self-signed certificate with CA

Jawad-Dev: I am working on a solution for file encryption via a combination of RSA and AES. RSA is basically used here for a handshake to encrypt a symmetric key and decrypt with the key pair at the receiver side. I have used Java keystore for private key and

Self-signed certificate with CA

Jawad-Dev: I am working on a solution for file encryption via a combination of RSA and AES. RSA is basically used here for a handshake to encrypt a symmetric key and decrypt with the key pair at the receiver side. I have used Java keystore for private key and

Self-signed certificate with CA

Jawad-Dev: I am working on a solution for file encryption via a combination of RSA and AES. RSA is basically used here for a handshake to encrypt a symmetric key and decrypt with the key pair at the receiver side. I have used Java keystore for private key and

Self-signed certificate with CA

Jawad-Dev: I am working on a solution for file encryption via a combination of RSA and AES. RSA is basically used here for a handshake to encrypt a symmetric key and decrypt with the key pair at the receiver side. I have used Java keystore for private key and

Self-signed certificate doesn't work - invalid CA

it Using openssl I am trying to install a ssl certificate on my server using Apache. Follow some links like this youtube tutorial . I was able to download/install openSSL running the following commands openssl genrsa -aes256 -out private.key 2048 openssl rsa -

nodejs - wrong self signed certificate in certificate chain

Doyle: I'm having issues with client side https requests. Fragments can look like this: var fs = require('fs'); var https = require('https'); var options = { hostname: 'someHostName.com', port: 443, path: '/path', method: 'GET', key: fs.re

nodejs - wrong self signed certificate in certificate chain

Doyle: I'm having issues with client side https requests. Fragments can look like this: var fs = require('fs'); var https = require('https'); var options = { hostname: 'someHostName.com', port: 443, path: '/path', method: 'GET', key: fs.re

nodejs - wrong self signed certificate in certificate chain

Doyle: I'm having issues with client side https requests. Fragments can look like this: var fs = require('fs'); var https = require('https'); var options = { hostname: 'someHostName.com', port: 443, path: '/path', method: 'GET', key: fs.re

Trusted CA on self-signed certificate

horny I have an old Linux based embedded device from a project about ten years ago. The device has no built-in UI, keyboard or anything like that, just a small web server to control it. I have since forgotten the passcode on the device and the company that ori

Trusted CA on self-signed certificate

horny I have an old Linux based embedded device from a project about ten years ago. The device has no built-in UI, keyboard or anything like that, just a small web server to control it. I have since forgotten the passcode on the device and the company that ori

Invalid certificate signed with custom CA in Kubernetes

Zevrant I am trying to setup the following process. Pod starts and generates private key and csr Submit csr to password protected service for signing and ip verification The service returns a valid crt, which is then packaged into a .p12 with the private key g

Invalid certificate signed with custom CA in Kubernetes

Zevrant I am trying to setup the following process. Pod starts and generates private key and csr Submit csr to password protected service for signing and ip verification The service returns a valid crt, which is then packaged into a .p12 with the private key g

OpenSSL: Error "Self-signed certificate in certificate chain"

Lunar Mushrooms: When I use the openssl API to verify the server certificate (self-signed), I get the following error: Error 1 Deep Look 19: Self-signed certificate in certificate chain According to the openssl documentation , this error (19) is "X509_V_ERR_SE

OpenSSL: Error "Self-signed certificate in certificate chain"

Lunar Mushrooms: When I use the openssl API to verify the server certificate (self-signed), I get the following error: Error 1 Deep Look 19: Self-signed certificate in certificate chain According to the openssl documentation , this error (19) is "X509_V_ERR_SE

OpenSSL: Error "Self-signed certificate in certificate chain"

Lunar Mushrooms: When I use the openssl API to verify the server certificate (self-signed), I get the following error: Error 1 Deep Look 19: Self-signed certificate in certificate chain According to the openssl documentation , this error (19) is "X509_V_ERR_SE