2

I need to create multiple intermediate certificates so the chain would be like this root >> int 1 >> int 2 >> user cert.

Till yet, I have created a root and an intermediate certificate (signed by root) and one more intermediate certificate (signed by the previous intermediate). Now, what would be the next process ?

If there would be single intermediate then the below mentioned command will be used.

openssl pkcs12 -export -out ia.p12 -inkey ia.key -in ia.crt -chain -CAfile ca.crt

Since, i have two of them, how will the command work ?

Any help will be appreciated.

Improve this question

1 Answer 1

Reset to default
1

From the documentation:

FILE CREATION OPTIONS
...
-in filename
The filename to read certificates and private keys from, standard input by default. They must all be in PEM format. The order doesn't matter but one private key and its corresponding certificate should be present. If additional certificates are present they will also be included in the PKCS#12 file.

In other words: all the certificates should be inside the file given by the -in argument.

Improve this answer
1
  • 2
    Or omit -in file and supply all certs on standard input, which can be done by piping from cat on Unix or type [2>NUL] on Windows. Note privatekey is not in -in/stdin when -inkey is specified. Alternatively, using -chain and having chain cert(s) in the truststore, as done in the Q, also works; for -CAfile that means concatenating them, for -CApath it means setting up hash-named links or files as described in the man page for verify(apps-or-1).
    – dave_thompson_085
    Nov 8, 2018 at 4:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .