0

I'm simply trying to create a self signed cert. I created a root cert from which I created

  • server key + cert and
  • client key + cert

While connecting to TLS server installed with server key + server cert, client fails with message Peer's Certificate issuer is not recognized.

To debug when I want to verify my root cert itself, I get error 18 at 0 depth lookup.

http://gagravarr.org/writing/openssl-certs/errors.shtml mentions "#2 could be because certificate is self signed and not trusted" but not sure how can I verify the root certificate.

Below is my config to create root cert,

root-ca.config

[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn

[ dn ]
C=US
ST=Seattle
L=Seattle
O=Duwamish
OU=SC
emailAddress=some.email@gmail.com
CN =localhost

cert

openssl req -newkey rsa:1024 -sha1 -keyout rootkey.pem -out rootreq.pem -config root-ca.conf
openssl x509 -req -in rootreq.pem -sha1 -signkey rootkey.pem -out rootcert.pem

Then I copied root cert to /etc/pki/tls/certs/ (Redhat os).

cp rootcert.pem /etc/pki/tls/certs/
sudo update-ca-trust extract

[root@ip-172-18-20-233 conf3]# ll /etc/pki/tls/certs
total 24
lrwxrwxrwx 1 root     root       49 Apr 17 07:59 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx 1 root     root       55 Apr 17 07:59 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
-rwxr-xr-x 1 root     root      610 Feb 28  2017 make-dummy-cert
-rw-r--r-- 1 root     root     2388 Feb 28  2017 Makefile
-rwxr-xr-x 1 root     root      829 Feb 28  2017 renew-dummy-cert
-rw-r--r-- 1 ec2-user ec2-user 1688 Aug 31 22:58 restapi-root-ca.cert
-rw-r--r-- 1 root     root     1342 Sep  1 05:58 restapi-server.cert
-rw-r--r-- 1 root     root      944 Sep  1 08:00 rootcert.pem

verify

openssl verify rootcert.pem 
rootcert.pem: /C=US/ST=Seattle/L=Seattle/O=Duwamish/OU=SC/emailAddress=some.email@gmail.com/CN=localhost
error 18 at 0 depth lookup:self signed certificate
OK

closed as unclear what you're asking by Steffen Ullrich, Tobi Nary, Steve, AJ Henderson, Bacon Brad Sep 1 '17 at 18:12

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Related to : stackoverflow.com/questions/13295585/… ? – M'vy Sep 1 '17 at 7:50
  • 2
    While the question seems to ask "how can I tell it to trust while verifying" you don't offer any information what "it" is. But, the trust needs to be setup as the client site and thus the actual ways to add this trust depend on what "it" is. Which means your question can not be answered. – Steffen Ullrich Sep 1 '17 at 7:56
  • @M'vy True, I started my work from that post openSSL certificate-verification on Linux, but I Can not verify the rootcert.pem – prayagupd Sep 1 '17 at 8:03
  • @SteffenUllrich I basically meant to ask how can I verify my root x509 certificate? I eventually want my client to trust to server certificate but above question is verifying the root certificate. Im not sure if Im making any sense. – prayagupd Sep 1 '17 at 8:12
  • @prayagupd: if you want to create a root certificate then it needs to be a CA certificate and thus have basicConstraints CA:true. Your certificate does not have this. But, there are enough guides on the internet on how to create your own CA so just follow these. – Steffen Ullrich Sep 1 '17 at 8:17
1

I'm answering to my own very newbie 101 question. I had to install root cert so that I could trust it.

I was updating redhat ca after copying my root cert to /etc/pki/tls/certs, but somehow it was not reloaded. I ended up copying the PEM manually to /etc/pki/tls/certs/ca-bundle.crt.

Not the answer you're looking for? Browse other questions tagged or ask your own question.