0

I'd like to use MacOS keychain to create a basic Root CA, which will be able to sign CSRs and/or Intermediate CA which will be able to do that.

For knowledge purpose, I'd like to create a Root, and Intermediate then our common internal SSL certificates, but IRL, only a root and some leaves are enough.

I'm trying many combinations of usage for the root and for the leaves. On MacOS, I just need to trust the Root certificate and the descendants are trusted (which is totally normal). But on Windows, no matter how I trust the Root, leaves are always flagged as untrusted, saying something like "This certificate is untrusted because the signing certificate can't issue certificates", even if I tick EVERY usage possible.

As an example, here is the RootCA.pem:

-----BEGIN CERTIFICATE-----
MIIDjTCCAnWgAwIBAgIBGTANBgkqhkiG9w0BAQsFADB3MQ8wDQYDVQQDDAZPUEgg
Q0ExHTAbBgNVBAoMFE9seW1waWMgUGFsYWNlIEhvdGVsMQwwCgYDVQQLDANDVE8x
FDASBgNVBAgMC0JyYXp6YXZpbGxlMQswCQYDVQQGEwJDRzEUMBIGA1UEBwwLQnJh
enphdmlsbGUwHhcNMTgwNDEwMTcyMzQ0WhcNMzgwNDA1MTcyMzQ0WjB3MQ8wDQYD
VQQDDAZPUEggQ0ExHTAbBgNVBAoMFE9seW1waWMgUGFsYWNlIEhvdGVsMQwwCgYD
VQQLDANDVE8xFDASBgNVBAgMC0JyYXp6YXZpbGxlMQswCQYDVQQGEwJDRzEUMBIG
A1UEBwwLQnJhenphdmlsbGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQDVGJe8JL4jy7Y0Ovb2yn1NKrbnWmDY4Y4gZ5U9fd1C2b0rjUYw0+gdIY+zZoC9
zqIOYpIIDhwcXQXTMGB0naAv+mmnmnmJh9PsyGZ7xl9UT/Z1scICpWUgOLC+9xO4
wa8kbA88P+j+6Ybg+CwRDRM4ut7jweQz/BGnK6C2QDLvuGOekLCQTzPMugJBImia
M1CfMqrbnYqP8U6ULRVu/GX7R1itsoMIm/IG6ZnDDLna4ReE5Fsxka7h7Mfqt8EH
Tcn7tBlV4QApEF+RIo2JpHHmw5UAZZqWUdUkk4sB7iVqiOvh3egEeWmpyK6pAa7S
dFnLk0SVEg/ociTj8l61OZtZAgMBAAGjJDAiMA8GA1UdEwEB/wQFMAMBAf8wDwYD
VR0PAQH/BAUDAwf/gDANBgkqhkiG9w0BAQsFAAOCAQEAM0vlrtpJS+kmVW7c0Kb3
OyQc9cSne9vcneu5vz8oPsMuv9N1emo8TKueiPEwPxNan/WqrLAanaMtpxP9XRco
O9JnlXqKzXxlym3abiKsV4XsxBC8gBlG5Gks5JNjj7pTpx9OwsShob0G/8RzBlUZ
LoP1iPpO0mDw8wwI5X1TbmYodmtpNeEcd1JtfZ1/iL0AMF+pE/FY1PYkBPs6S7mb
iWePjRv2QuVGv0dSzpJAPcAILmwLvHRVRB4DrV/liJ9DfiEjnQHV0SJfvc/tJcYs
hEDMxLEm+2l4XsEWAmjlZMDIf1jZFKgXRsEAHHn1F4OxqspTmfhAFns6v9SKtQk7
ow==
-----END CERTIFICATE-----

Here is the leaf certificate.pem:

-----BEGIN CERTIFICATE-----
MIIEGzCCAwOgAwIBAgIBATANBgkqhkiG9w0BAQsFADB3MQ8wDQYDVQQDDAZPUEgg
Q0ExHTAbBgNVBAoMFE9seW1waWMgUGFsYWNlIEhvdGVsMQwwCgYDVQQLDANDVE8x
FDASBgNVBAgMC0JyYXp6YXZpbGxlMQswCQYDVQQGEwJDRzEUMBIGA1UEBwwLQnJh
enphdmlsbGUwHhcNMTgwNDEwMTczMDMwWhcNMjMwNDA5MTczMDMwWjCBpzEUMBIG
A1UEAwwLbGFuLm9waC5vdmgxHTAbBgNVBAoMFE9seW1waWMgUGFsYWNlIEhvdGVs
MQswCQYDVQQLDAJJVDEUMBIGA1UECAwLQnJhenphdmlsbGUxCzAJBgNVBAYTAkNH
MRQwEgYDVQQHDAtCcmF6emF2aWxsZTEqMCgGCSqGSIb3DQEJARYbaXRAb2x5bXBp
Yy1wYWxhY2UtaG90ZWwubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEA1OKgramUyEMaByWJq6vXHR1n3Ump8qaE+iFgJIU4p+c9jfVMJuRtECcSJejI
IKp+0um5rCJAeFNSmyLmMGp+zjmLTUySrrl/ZJKhwLolxJCK68MOJJ6CVEJammO6
dA55RIgukHpRsUnlUdu+VpQB7dsKreG44b23jpa5w3l4Hknb7lGxOPXjAya8kfiZ
lObbBne1xdOLQfjdHqpUvjJHv0uajq+R/YnoH7Dfp3UVNZ4rWwAtHcJbOpLAam4c
FcsDy+pG1ng2yryup+fGK0HjvSHhj6VjCJqZysJGF3zIFwEugoN0liCK6GsM6vM5
fm0FbEFoLvnrrfPdWP3gEcex5wIDAQABo4GAMH4wDwYDVR0TAQH/BAUwAwEBADAO
BgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMDwG
A1UdEQQ1MDOBG2l0QG9seW1waWMtcGFsYWNlLWhvdGVsLm5ldIIJKi5vcGgub3Zo
ggkqLm9waC5sYW4wDQYJKoZIhvcNAQELBQADggEBAD+2KDcJ/XGLdfMsHWgn6au/
daGn0HAvjOvHDqBN+HG9zVrVa+C1IpoPFI9ZMfe5W4Ju2RFEZLAT1l4rMVghsHO2
hQ6Jf/PZE+4K68C6ewp0isDDzah9w8nZ8N7LZHSVq2AaQQX3Zv7yOIxvpkeEjhzI
GInZM+UVJhbdV4g5Om+dcAMWjEQJN+AvAATZdJogfbPDEmHG+RbfTqn9L+ycA75t
/uXdTxN3kdSS/iBfk07ZFTKB2nhJJPwI1NJHM6LBbfY9lIQnxAiyKaWMprZztWIC
oAS1tjTchbWQERYNBQ+kxIkgQLjVr4PL5F0Ji2FjWfRscMuXdPowFTpJ1exDC3M=
-----END CERTIFICATE-----

And here is the leaf certificate private key (decrypted):

Bag Attributes
    friendlyName: lan.oph.ovh
    localKeyID: E7 36 A4 85 FC 43 2A F9 79 01 36 37 80 BB 00 38 30 74 0E 47 
Key Attributes: <No Attributes>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDU4qCtqZTIQxoH
JYmrq9cdHWfdSanypoT6IWAkhTin5z2N9Uwm5G0QJxIl6Mggqn7S6bmsIkB4U1Kb
IuYwan7OOYtNTJKuuX9kkqHAuiXEkIrrww4knoJUQlqaY7p0DnlEiC6QelGxSeVR
275WlAHt2wqt4bjhvbeOlrnDeXgeSdvuUbE49eMDJryR+JmU5tsGd7XF04tB+N0e
qlS+Mke/S5qOr5H9iegfsN+ndRU1nitbAC0dwls6ksBqbhwVywPL6kbWeDbKvK6n
58YrQeO9IeGPpWMImpnKwkYXfMgXAS6Cg3SWIIroawzq8zl+bQVsQWgu+eut891Y
/eARx7HnAgMBAAECggEBAJLwFf2oBjSv9CAorbybcG/9IvqfZLlCbJiFPuoWNgPW
XStFu5lAo3K5tRILeU7qv3zurCR+w8cJpAPGc+HJL9tB5r+k8b299YtClnkDQxxI
tEqEqJdn/QcRgZ385e5DKzq9UH6Snx5ipfD5Xog9wpMdVGKuYUEXBMJbkL62cc1c
5JraBNvUPDoIkLI1fyBz2ZEc9Iz4wweSk2IldPCXXHmL2OLDSDwsl9HpJoMJTt8S
PaWTOOBrCBtW9if6vvwZDPOpdHISdfhg/N+ifE0eYn2s8cxPs/9Y1dDo2L5gS8re
pOB4LAaeOos4mvQ8808HLX8Y9M+iuM3Qr8ToiGvkbTkCgYEA+EPHTfkllDUn2fel
6+zxJv4omKZupJ3Bvx/g+AjFBnAzkMVkcuhRA7B5dlBq3f2N1QFBBJJnkmF7z3Mu
IAXTM5MOuwqgywApA/voK0p5ZragP9WZR/5+SakWeVF+Vk1Zvu816ppLBXW64H6+
t+YRqa1KYAVj8xbgATxGb81QmPsCgYEA24SnSTBbhvMMaZoUGecIf29Pxx4+WAkh
Dq1Q0V1CH/zBIYvgnN1cI4E/TFcrzHhxmxtb5B6PYpZfD59tzvbKGNPL64hAqWwg
4IFuvNpw2aJptQGz9D6Vu61kAe4m/5Hw6wcJN3o73pMGV3CuoyHqYj85vqCasbFP
vOitYUpaDwUCgYBfQsqn/bDQtLDM7zyoUWubFa0IHdyYp7vfFWFiayMGvGjc5REN
El17t+xzXJoVAiS5FdkX4wGA5oz2ZfDN8s4+nO/rD0Hxguc6Ex/b9KCuq+bDd7dw
K5PTueDYvk9m2BlWrT0X/wpIVwtU9u1BbTNb0xWV0JuwfBeKAdHZNoP1nwKBgQCf
YlGT8miCMzZv9k9h/z1MSaXDDVJ22SoHXg+v8+ZvEzWnBciwHIkpvk4XP7OtYkYa
OGMf3pB9JHEhBsDT5JwYKq+E9Aj++mNknpWoyXHmkuXtZq8iR86v1dUnEaN/LJeg
DhvDDB0sHdQc6NPj3lwvuXhT0IiBPByJLOe2HCYHgQKBgDNRAJ4C1SAAW3XXnoCL
kjnvaXk0plj7Sh1JfZiipZun2Gl99JX68aNh+5bnm5Yq+jQHKHmAQfHnXW4Nyjk7
vmlI+LGZvwVkKQn6xORWNz3T0CUD9MHNCWN5CNL6HJJ3mBYDqpjC5n2i10/tF2Jv
WtTYDNeQf1HnCLuoDSV1y/nB
-----END PRIVATE KEY-----

Can someone help me understand why this certificate can't be trusted on Windows and what did I possibly miss please?

4

It seems to be valid to me. Windows does not complain about the leaf certificate if I install the CA. XCA also confirms the leaf as trusted.

Are you using browser that uses its own list of trusted roots, like Firefox?

  • Now you mention it... I do. Without knowing it, I tried with FF (so, I trusted the root on the wrong store) and with chrome. Does chrome also have its own store? – Max13 Apr 24 '18 at 23:40
  • @Max13 No, chrome should use the root store of the OS according to their policy: chromium.org/Home/chromium-security/… – Peter Harmann Apr 24 '18 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.