hi there, thanks Dr. Henson your tips have been very useful to me, you were right, there is an -signca option, the same about my crl question, i generated it again and it finally registered my revoked certificates.
However my question about uninstalling openssl is still without an answer, if someone could tell me something about it. i'll thank a lot. Finally, about the process Dr. Henson gave me to create a suboridinate CA i got my root CA's certificate to fail when i try to sign with it. I mean, i create the subordinate CA's certificate but i couldn't sign nothing with it, and when i tried to sign with the certificate of my original CA (root) i couldn't either. This have been fixed creating my cert again but maybe i didn't understand about changing directories because the errors where about loading the appropriate certificate. Regarding this, should i move the cacert.pem into a new directory as well as CA.pl file and inside that directory try to sign??? if so, i suppose after done that i make CA.pl -newca right, or what files should i move to a new directory, thanking again for your help, i'll expect your answer. Juan Carlos Albores Aguilar ----- Original Message ----- From: "Dr S N Henson" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 18, 2001 5:32 PM Subject: Re: subordinate CA > Juan Carlos Albores Aguilar wrote: > > > > thanks for the tip but CA.pl it doesn't have a -signca option, maybe i > > didn't understand you, but i did CA.pl -newca and ask me for an > > existing CA or for creating a new one so i put that i already have one > > and that's it. When i tried with -sign, my problem was that i don't > > know how to make csr for a new CA (a subordinate), in the faq of modssl > > it says how to make your own CA but with a self signed certificate, so > > please tell me how to make a csr that my CA (root) could sign as a > > certificate of a subordinate CA. > > With CA.pl please explain me again, i'm new with all this, or even if > > there's some other ways to do that please let me know. Thanks. > > > > You create a certificate request as usual, but filling in the fields you > want to appear in the subordinate CA. The CA.pl option is actually > -signCA if you don't have that then try the latest version of OpenSSL. > > In outline you'd do something like this: > > CA.pl -newca > [enter CA fields] > CA.pl -newreq > [enter subordinate CA fields] > CA.pl -signCA > cat newreq.pem newcert.pem >cacert.pem > [change to a different directory] > CA.pl -newca > [give path to cacert.pem] > > you should then have a subordinate CA in this directory and you can sign > requests with it as normal. You need to change directories because CA.pl > will use ./demoCA in the current directory. > > Steve. > -- > Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/ > Personal Email: [EMAIL PROTECTED] > Senior crypto engineer, Gemplus: http://www.gemplus.com/ > Core developer of the OpenSSL project: http://www.openssl.org/ > Business Email: [EMAIL PROTECTED] PGP key: via homepage. > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [EMAIL PROTECTED] > Automated List Manager [EMAIL PROTECTED] > _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
