I'm making a certificate chain:


When my certificates are installed, the intermediate certificate has an error:

This certification authority is not allowed to issue certificates or cannot be used as an end-entity certificate.

As a result, my server certificate is invalid.

My code:

#Root CA
OpenSSL> genrsa -out root.key 4096
OpenSSL> req -new -x509 -days 1826 -key root.key -out root.crt

#Intermidiate CA
OpenSSL> genrsa -out intermediate.key 4096
OpenSSL> req -new -key intermediate.key -out intermediate.csr

#Root signs Intermidiate
OpenSSL> x509 -req -days 1826 -in intermediate.csr -CA root.crt -CAkey root.key -CAcreateserial -out intermediate.crt

#Server CA
OpenSSL> genrsa -out server.key 4096
OpenSSL> req -new -key server.key -out server.csr

#Intermediate signs Server
OpenSSL> x509 -req -days 1826 -in server.csr -CA intermediate.crt -CAkey intermediate.key -CAcreateserial -out server.crt

My config file:

dir                     = .

[ ca ]
default_ca              = CA_default

[ CA_default ]
serial                  = $dir/serial
database                = $dir/certindex.txt
new_certs_dir           = $dir/certs
certificate             = $dir/cacert.pem
private_key             = $dir/private/cakey.pem
default_days            = 365
default_md              = md5
preserve                = no
email_in_dn             = no
nameopt                 = default_ca
certopt                 = default_ca
policy                  = policy_match
x509_extensions         = v3_ca

[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
default_bits            = 1024              # Size of keys
default_keyfile         = key.pem           # name of generated keys
default_md              = md5               # message digest algorithm
string_mask             = nombstr           # permitted characters
distinguished_name      = req_distinguished_name
req_extensions          = v3_req
keyUsage                = digitalSignature, nonRepudiation
extendedKeyUsage        = serverAuth,clientAuth,emailProtection,codeSigning 

[ req_distinguished_name ]
# Variable name                Prompt string
#-------------------------    ----------------------------------
commonName                     = Common Name (hostname, IP, or your name)
commonName_max                 = 64
0.organizationName             = Organization Name (company)
organizationalUnitName         = Organizational Unit Name (department, division)
emailAddress                   = Email Address
emailAddress_max               = 40
localityName                   = Locality Name (city, district)
stateOrProvinceName            = State or Province Name (full name)
countryName                    = Country Name (2 letter code)
countryName_min                = 2
countryName_max                = 2

# Default values for the above, for consistency and less typing.
# Variable name                Value
#------------------------     ------------------------------
0.organizationName_default     = My Company
localityName_default           = My Town
stateOrProvinceName_default    = State or Providence
countryName_default            = US

[ v3_ca ]
basicConstraints            = CA:TRUE
subjectKeyIdentifier        = hash
authorityKeyIdentifier      = keyid:always,issuer:always

[ v3_req ]
basicConstraints            = CA:TRUE
subjectKeyIdentifier        = hash

[ usr_cert ]
basicConstraints            = CA:TRUE

Honestly, I'm a beginner when it comes to making certificates. My configuration file was copied from the internet. I need some help. What am I doing wrong? How do I get rid of the error?

  • 2
    Please get yourself a better config "from the internet" or even better a tutorial like this one. You are creating x509v1 instead of x509v3 certificates, use the totally insecure MD5 as signature algorithms etc. It's not worth to get into the details of what you all do wrong, please start from scratch but not from some broken config. Mar 2, 2017 at 16:40
  • @SteffenUllrich The problem with the tutorial you linked to is that it's for Linux and I'm using Windows. Mar 2, 2017 at 20:49
  • 2
    This Linux specific stuff involves almost only the commands to create a directory, change the directory, look at a file and the path separator. The openssl commands should still work on Windows too with no or tiny modifications (like path). I suggest that you actually try to understand what is done in the tutorial instead of just blindly copying commands. And once you understood this it should be easy to adapt to the Windows environment. Mar 2, 2017 at 20:55

1 Answer 1


I think your problem is that your intermediate CA is actually just a 'regular' cert, with the following extensions:

keyUsage                = digitalSignature, nonRepudiation
extendedKeyUsage        = serverAuth,clientAuth,emailProtection,codeSigning

Although you did set

[ v3_req ]
basicConstraints            = CA:TRUE

(which is not something you really should be doing), you need something else.

Per man x509:

A CA certificate must have the keyCertSign bit set if the keyUsage extension is present.

I realise you are probably trying to do the 'right thing' here by having an intermediate doing the day-to-day issuance, you might consider making things a little simpler for yourself while you research openSSL and using it to generate PKIs (aka: read at least https://www.feistyduck.com/books/openssl-cookbook/). Also check the 'Certificate Extensions' section in https://www.openssl.org/docs/manmaster/man1/x509.html.

I would suggest you look at cfssl to help you get the cert you need right now, if you don't have the leisure to research things thoroughly at the moment. You might also want to take a look at Hashicorp's Vault.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .