1

I want to cross-sign a third-party certificate (third-party-client.crt) with my own root ca (r1).

To do this, I use

openssl x509 -in third-party-client.crt -CA /etc/pki/r1/ca.crt -CAkey /etc/pki/r1/private/ca.key -out third-party-client-cross-signed.crt -set_serial 1000

When I don't have the CA that issued the third party certificate in my local CA store, I get the following error:

Getting CA Private Key
/CN=Third Party Client Cert
error with certificate - error 20 at depth 0
unable to get local issuer certificate
/CN=Third Party Client Cert
error with certificate - error 21 at depth 0
unable to verify the first certificate
error with certificate to be certified - should be self signed

After adding the certificate that issued the third party cert to the CA store, I still get the following error:

Getting CA Private Key
error with certificate to be certified - should be self signed

How can I cross-sign a non-self-signed third-party certificate? (Ideally, without first importing the issuer ca into the CA store)

Improve this question
5
  • 1
    Use version 1.1.1 (or lower, but those are officially EOL); it gives the verify errors, but proceeds anyway. Both older and current code has a comment saying the cert 'should be self-signed' so it appears this check was always intended but just didn't quite work before -- although I don't see why it should. (It might be an analogy to issuing from a CSR, which is required to be selfsigned, but I consider that a wrong analogy.) I was going to also point you to serverfault.com/questions/1103302 but I see that's unnecessary.
    – dave_thompson_085
    Jun 24, 2022 at 5:01
  • Atleast on 1.1.1n, it doesn't work. (An empty out-file is created though) Do you know in which specific version it still works? (Still, this obviously isn't a great solution) The best path forward (atleast knowing why it behaves this way) would probably be the openssl-users list?
    – Zulakis
    Jun 24, 2022 at 10:52
  • I have tried with 1.1.0j and got the same issue (it creates an empty -out file)
    – Zulakis
    Jun 24, 2022 at 14:34
  • I hit the same error on a Windows version of “OpenSSL 1.1.1o 3 May 2022”. I tried exactly the same command on Ubuntu’s current “OpenSSL 3.0.5 5 Jul 2022 (Library: OpenSSL 3.0.5 5 Jul 2022)” and it worked without problems.
    – Mormegil
    Mar 21 at 10:25
  • @Mormegil I tried it again OpenSSL 3.0.5 5 Jul 2022 on ubuntu, but ran into the exact same errors mentioned in my OP. Are you sure that the third party certificate you are signing is indeed not self-signed?
    – Zulakis
    May 29 at 13:11

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .