0

My plan is to create rootCA.crt and sign newly created server.crt. Later server.crt should sign newly created child.crt. As result I will get small chain.

Now I would like to test if child certificate was signed by server one:

openssl verify -CAfile child.crt server.key

Got error:

PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: TRUSTED CERTIFICATE

What I need to do in order to verify certificate?

Certificate create history:

ROOT certificate:

 openssl req -x509 -sha256 -days 356 -nodes -newkey rsa:2048 -subj "/CN=www.aaa.com /C=US/L=San Fransisco" -keyout rootCA.key -out rootCA.crt

Server certificate

Key generation:

openssl genrsa -out server.key 2048

Content of csr.conf:

[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C = US
ST = California
L = San Fransisco
O = MLopsHub
OU = MlopsHub Dev
CN = www.aaa.com

Command:

openssl req -new -key server.key -out server.csr -config csr.conf

Content of cert.conf:

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

openssl x509 -req -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server.crt -days 365 -sha256 -extfile cert.conf

Child certificate

openssl genrsa -out child.key 2048

Content of csr_child.conf

[ req ]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn

[ dn ]
C = US
ST = California
L = San Fransisco
O = MLopsHub
OU = MlopsHub Dev
CN = www.aaa.com

openssl req -new -key child.key -out child.csr -config csr_child.conf

Content of cert_child.conf

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

Command:

openssl x509 -req -in child.csr -CA server.crt -CAkey server.key -CAcreateserial -out child.crt -days 365 -sha256 -extfile cert_child.conf
2
  • 1
    Later server.crt should sign newly created child.crt. this is bad plan. End entity certificates cannot sign other certificates. Both server.crt and child.crt should be signed by same root CA. And you should not create additional chain elements without a real need.
    – Crypt32
    Sep 15, 2022 at 16:44
  • openssl verify -CAfile child.crt server.key - you are trying to verify the servers private key - but you are supposed to use the certificate you want to verify here. That's why you get the error about unexpected input data. And if you want to verify if the child.crt was issued by the server then the server should be the trusted thing (-trusted, -CAfile) and not the child. As for the idea of signing the child by the server in the first place - see the comment from Crypt32. Sep 15, 2022 at 17:08

0

You must log in to answer this question.

Browse other questions tagged .