Geek Answers Handbook

Validating openSSL Certificate on Linux

Jkjs

I have this certificate chain: rcert.pem (self-signed) -> scert.pem -> ccert.pem

All three certificates are created by me. The internet connection is not used anywhere. This is perfect battery life. Below are some commands and their output:

hari@harikrishna :~/hari$ openssl verify rcert.pem rcert.pem: C = IN, ST = OM, L = OM, O = HARI, OU = HARI, CN = OM, emailAddress = OM error 18 at 0 depth lookup:self signed certificate OK hari@harikrishna :~/hari$ openssl verify -CAfile rcert.pem scert.pem scert.pem: OK hari@harikrishna :~/hari$ openssl verify -CAfile rcert.pem rcert.pem rcert.pem: OK hari@harikrishna :~/hari$ openssl verify -CAfile rcert.pem -untrusted scert.pem ccert.pem ccert.pem: C = IN, ST = HARI, L = HARI, O = HARI, OU = HARI, CN = HARI, emailAddress = HARI error 24 at 1 depth lookup:invalid CA certificate OK

Why is error 24. created? How to remove it? Is it something like trusted or untrustworthy?

Thanks.

+7
source share
1 answer

Jkjs

Got an answer to my question:

1) Created a root CA certificate with these commands:

 openssl req -newkey rsa:1024 -sha1 -keyout rootkey.pem -out rootreq.pem openssl x509 -req -in rootreq.pem -sha1 -signkey rootkey.pem -out rootcert.pem

2) The installed CA certificate as a trusted certificate with the following commands:

 sudo mkdir /usr/share/ca-certificates/extra sudo cp rootcert.pem /usr/share/ca-certificates/extra/rootcert.crt sudo dpkg-reconfigure ca-certificates sudo update-ca-certificates

3) Created an intermediate certificate signed by the root certification authority with the following commands:

 openssl req -newkey rsa:1024 -sha1 -keyout skey.pem -out sreq.pem sudo openssl x509 -req -in sreq.pem -sha1 -CA /etc/ssl/certs/rootcert.pem -CAkey rootkey.pem -CAcreateserial -out scert.pem

4) The created client certificate, signed by the intermediate CA, with the following commands:

 openssl req -newkey rsa:1024 -sha1 -keyout ckey.pem -out creq.pem openssl x509 -req -in creq.pem -sha1 -CA scert.pem -CAkey skey.pem -CAcreateserial -out ccert.pem

Now Chain Of Trust is working fine:

1) root CA check

 openssl verify rootcert.pem rootcert.pem: OK

2) intermediate CA verification

 openssl verify scert.pem scert.pem: OK

3) verification of client certificate

 openssl verify -CAfile scert.pem ccert.pem ccert.pem: OK
+17
source

More articles:


All Articles