Bad OpenSSL Certificate

Question

I am trying to make a fake CA and sign a certificate with it for use with stunnel (which seems to call OpenSSL procedures, so you probably don't need to know the program to help :). However, stunnel continues to reject my certificate, saying that it is not signed with the right key!

This is how I generate my keys and certificates using OpenSSL:

openssl genrsa -out ca_key.pem 1024 openssl req -config ./root2.cfg -new -sha1 -x509 -key ca_key.pem -out ca_cert.pem -subj "/CN=blah.blah.com/OU=Dev blah CA/C=CA/ST=blah/L=blah/O=Blah Software" openssl genrsa -out MPS_key.pem 1024 openssl req -config ./MPS2.cfg -new -sha1 -key MPS_key.pem -out MPS_cert_req.pem -subj "/CN=blah.blah.com/OU=blah Certificate/C=CA/ST=blah/L=blah/O=Blah Software" openssl x509 -req -in MPS_cert_req.pem -signkey ca_key.pem -out MPS_cert.pem -extensions MPS_ext 

Then my stunnel.conf has the following entries:

 CAfile = ca_cert.pem key = MPS_key.pem cert = MPS_cert.pem 

When I try to start stunnel, I get a general OpenSSL error "key does not match certificate":

 2009.09.09 16:36:04 LOG3[492:172]: SSL_CTX_use_RSAPrivateKey_file: B080074: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch 

Did I do something wrong in creating my files?

Answer 1

I will summarize what you have installed:

• You have a CA certificate that is self-signed.
• You have a MPS_cert that is self-signed.
• You signed MPS_cert with a CA key.

If you read the link for the OpenSSL x509 command ( http://openssl.org/docs/apps/x509.html ), you will see that the -signkey parameter points OpenSSL to itself -Change the attached certificate with this private key. This is not what you want.

What you want to do is create a self-signed CA and then use it to sign the CSR and create a valid certificate.

 openssl verify ca_cert.pem ca_cert.pem: /CN=blah.blah.com/OU=Dev blah CA/C=CA/ST=blah/L=blah/O=Blah Software error 18 at 0 depth lookup:self signed certificate OK openssl verify MPS_cert.pem MPS_cert.pem: /CN=blah.blah.com/OU=blah Certificate/C=CA/ST=blah/L=blah/O=Blah Software error 18 at 0 depth lookup:self signed certificate OK 

The relevant options are -CA, -CAkey and -set_serial

 openssl x509 -CA ca_cert.pem -CAkey ca_key.pem -set_serial 1 -req -in MPS_cert_req.pem -out MPS_cert2.pem -days 365 

This should result in a certificate signed by your CA that you yourself have signed.