Riiber Arne AV/G(NES/ETO/I/KE) wrote:
>
> Hello, openssl-users.
>
> I try to generate a pkcs12 file that can be imported in Netscape by
> doing the following command sequence:
>
> # create random state
> openssl md5 * > rand.dat
>
> # generate a private key protected with a passphrase
> openssl genrsa -rand rand.dat -des3 1024 > key.pem
>
> # generate a dummy self-signed certificate
> openssl req -new -x509 -key key.pem -out selfsigned.pem
>
> # Generating PKCS#12 files
> openssl pkcs12 -export -in selfsigned.pem -out selfsigned.p12 -name
> "selfsigned"
>
> The last command fails with the following error message:
>
> Error loading private key
> 13372:error:0906D06C:PEM routines:PEM_read_bio:no start
> line:pem_lib.c:662:Expecting: ANY PRIVATE KEY
>
> Do you have any tips of how to solve this?
>
Yes simple advice DON'T DO IT.
PKCS#12 files can only be used to import CAs when they import a user
certificate. That is you need to include a user certificate, its private
key and some optional CA certificates.
You can't use PKCS#12 to just import a CA certificate because you need
to include the private key.
Don't even think of including the CA private key and giving that to a
user!
Even if you do the CA will end up installed as a user certificate and
Netscape can't use a self signed user certificate.
There are two methods of adding CA certificates to Netscape: send the
data to the browser as MIME type application/x-x509-ca-cert either by
clicking on a link that does this or as an email attachment.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
