0

I want to cross-sign a third-party certificate (third-party-client.crt) with my own root ca (r1).

To do this, I use

openssl x509 -in third-party-client.crt -CA /etc/pki/r1/ca.crt -CAkey /etc/pki/r1/private/ca.key -out third-party-client-cross-signed.crt -set_serial 1000

When I don't have the CA that issued the third party certificate in my local CA store, I get the following error:

Getting CA Private Key
/CN=Third Party Client Cert
error with certificate - error 20 at depth 0
unable to get local issuer certificate
/CN=Third Party Client Cert
error with certificate - error 21 at depth 0
unable to verify the first certificate
error with certificate to be certified - should be self signed

After adding the certificate that issued the third party cert to the CA store, I still get the following error:

Getting CA Private Key
error with certificate to be certified - should be self signed

How can I cross-sign a non-self-signed third-party certificate? (Ideally, without first importing the issuer ca into the CA store)

3
  • 1
    Use version 1.1.1 (or lower, but those are officially EOL); it gives the verify errors, but proceeds anyway. Both older and current code has a comment saying the cert 'should be self-signed' so it appears this check was always intended but just didn't quite work before -- although I don't see why it should. (It might be an analogy to issuing from a CSR, which is required to be selfsigned, but I consider that a wrong analogy.) I was going to also point you to serverfault.com/questions/1103302 but I see that's unnecessary. Jun 24 at 5:01
  • Atleast on 1.1.1n, it doesn't work. (An empty out-file is created though) Do you know in which specific version it still works? (Still, this obviously isn't a great solution) The best path forward (atleast knowing why it behaves this way) would probably be the openssl-users list?
    – Zulakis
    Jun 24 at 10:52
  • I have tried with 1.1.0j and got the same issue (it creates an empty -out file)
    – Zulakis
    Jun 24 at 14:34

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.