On Thu, 25 Oct 2007, Brian Mathis wrote:

On 10/25/07, Tom Diehl <[EMAIL PROTECTED]> wrote:
Hi,

Does anyone have a pointer to correct documentation for generating and
installing a self signed ssl cert for use on httpd on a C-5 machine?

The docs say to use genkey but AFAIK upstream rm'd crypto-utils from the
distro and as such it is not available. I tried generating the cert on a C-4
machine using genkey and installing on the C-5 machine but I get the following
error when I try to connect:

[...]

Can anyone tell me where I am going wrong here? Google is not being helpful
and I am getting frustrated. I wish I better understood open ssl. :-(

Regards,

--
Tom Diehl               [EMAIL PROTECTED]             Spamtrap address [EMAIL 
PROTECTED]


You might find a bunch of guides online that give you ways to do it
using openssl, but C5 has a Makefile already set up to do this for
you.  Steps:
1. cd /etc/pki/tls/certs
2. make testcert
3. restart apache

The default ssl.conf file points to the localhost.* files that are
generated by this command.

Ok, So I changed the Makefile from localhost to match the actual hostname of
the machine. I then ran "make testcert" as suggested above and answered the
questions as appropriate. It then generated the cert without errors. I then
modified ssl.conf to point to the .key file and the .crt file, restarted apache.

Everything looked OK in the logs. I then pointed a browser at the machine and I
got the following errors in the ssl error log:

[Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1770): OpenSSL: Write: 
SSLv3 read client certificate B
[Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1789): OpenSSL: Exit: 
error in SSLv3 read client certificate B
[Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1789): OpenSSL: Exit: 
error in SSLv3 read client certificate B
[Thu Oct 25 14:31:25 2007] [info] [client 192.168.0.3] SSL library error 1 in 
handshake (server roadrunner.example.com:443)
[Thu Oct 25 14:31:25 2007] [info] SSL Library Error: 336105671 
error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a 
certificate No CAs known to server for verification?
[Thu Oct 25 14:31:25 2007] [info] [client 192.168.0.3] Connection closed to 
child 0 with abortive shutdown (server roadrunner.example.com:443)

In addition I catted the key and crt together to make a .pem and ran verify
on the cert. I got the following output:

(roadrunner pts1) # openssl verify roadrunner.example.com.pem
roadrunner.example.com.pem: /C=US/ST=Pennsylvania/L=Mytown/O=TN Techs 
LLC/CN=roadrunner.example.com/[EMAIL PROTECTED]
error 18 at 0 depth lookup:self signed certificate
OK
(roadrunner pts1) #

Am I correct that the above error is normal for a self signed cert?

Obviously I am missing something. Can anyone point me at a solution to this
problem?

Regards,

--
Tom Diehl               [EMAIL PROTECTED]               Spamtrap address [EMAIL 
PROTECTED]
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

Reply via email to