Re: Creating a self-signed CA cert

kwhiskers wrote:
>
>
> On 03/11/05, *Steven Stromer* <filter@xxxxxxxxxxxxxxxxx
> <mailto:filter@xxxxxxxxxxxxxxxxx >> wrote:
>
>      >>>I want
>      >>>to create a self-signed CA cert, which is most easily achieved
>     using the
>      >>>ca.pl script. This is no longer anywhere to be found, along with the
>      >>>demoCA folder that one would normally expect to find. Can anyone
>     shed
>      >>>some light on where these files ended up? I can't find them on a
>     search.
>
>      >>The perl script is in the openssl-perl package.  The original
>     split was
>      >>needed to keep the openssl package from depending on perl, which
>     isn't
>      >>part of the "Base" package component/group.
>      >>
>      >>It looks like the generated data files would now be placed in
>     /etc/CA,
>      >>but of course that's configurable in openssl.cnf.
>      >>
>      >>HTH,
>      >>
>      >>Nalin
>
>      > It seems to me that certificates can be created using :
>      > /etc/pki/tls/certs/Makefile
>      > -------------------------------------------
>      > Aaron Konstam
>
>     Thank you all for your replies. I was aware of the line:
>
>     'OpenSSL: the /usr/share/ssl contents have moved to /etc/pki/tls and
>     /etc/pki/CA.'
>
>     in FC4's Release Notes. However, within the new path, there are many
>     files missing that were available in the old path.
>
>     Nalin helped to explain some of the missing files by documenting that
>     openssl and openssl-perl are seperate packages. That helps to explain
>     some of the missing script files.
>
>     Before learning this I manually executed all of the commnands I needed
>     to create my CA and host certificates and keys using openssl commands,
>     which are easier to use, in my opinion, than the perl scripts that
>     exist
>     to help in these steps. But, that's just a matter of opinion, and I
>     understand that there are a number of scripts that perform very
>     convenient file conversion, that I may find myself reaching for sometime
>     in the future.
>
>     For the moment, I've skipped installing the openssl-perl package, just
>     to keep life as simple as possible (less to learn, secure, and just deal
>     with!).
>
>     The Makefile is also very helpful for at least creating a pem styled
>     csr
>     (make certreq).
>
>     However, this is where the remaining missing files and directories come
>     into play. I want to sign my newly minted request with my own CA cert,
>     but I am getting errors having to do with the configuration of
>     openssl.cnf. There seem to be a number of 'mistakes' in the CA_default
>     section of the configuration file. The first attribute 'dir', has a
>     value of '../../CA', which seems faulty to me. Worse, a few lines
>     later,
>     the 'crl_dir', 'serial', 'crl' and a number of other attributes have
>     values that point to directories and files that simply DO NOT EXIST!
>
>     I have attempted to create some of the missing directories, which gets
>     me past the first few errors when executing:
>
>     openssl ca -config /etc/pki/tls/openssl.cnf -policy policy_anything -out
>     www.domainname.com.pem -infiles www.domainname.com.request.pem
>
>     but, eventually I get to errors relating to the missing files (ie.
>     index.txt) and I grind to a halt.
>
>     Has anyone successfully created CA and signed their own certs using a
>     'default' installation of FC4? Did you have to take any extraordinary
>     steps to achieve this?
>
>     Thanks everyone for the responses. Sorry this is more involved than it
>     first seemed.
>
>     Steven Stromer
>
>     --
>     fedora-list mailing list
>     fedora-list@xxxxxxxxxx <mailto: fedora-list@xxxxxxxxxx>
>     To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>
>
> I am waiting with bated breath for the answer.
>
> I had created a certificate manually, with openssl pkcs
> somethingorother, which generated the certificate and imported
> successfully into konqueror, firefox and mozilla.
>
> This morning, I discovered the makefile in /etc/pki/certs and tried make
> certificatename.pem and that worked also.
>
> I have placed these certificates into every directory I can think of in
> the /etc/pki tree, as well as having imported them into the
> aforementioned programs.
>
> I am unable to use these certificates to sign a document in open office,
> however.
>
> As for your problem, I cannotoffer any more information, but I feel that
> the solutions are allied.
>

It would seem that signing a certificate should be a fairly
straightforward, and common action; al least common enough for some list
readers to be able to say 'yes, I can do this without a problem in FC4',
or 'no, I'm experiencing the same problems'. I am becoming more and more
convinced that this is an issue of misconfiguration of the present
openssl package, which might warrant a bug listing. There is some
interesting, and very good, documentation on openssl.cfg at:

http://www.technoids.org/openssl.cnf.html

It has helped me to understand better what is failing to work, some of
which I described in an earlier posting in this thread. There are now a
few people needing help here! Any brains in shining armor around?

Thanks again!

Steven Stromer