Dear Openssl users,
In a windows 2000 environment I am attempting to create
1- Root CA
2- IIS https cert
3- multiple client certificates. (to install on IE browsers)
I seem to be able to do the above, although when attempting to use my client
certs I receive a 403.7 error
The root cert is trusted on both the IIS machine and the client machine,
with the certification path being valid.
I have pasted the method which I am creating the certificates with below.
Can somebody please point out where I am likely to be going wrong?
(I can send the CA.cnf file I am using if it will help)
Hoping you can help.
Regards,
Jared Clinton
NEC Business Solutions Australia
----------------
Overview:
Create self signed CA to act as the root authority.
Store the certificate and key for use with further certificate requests
Install the Root CA certificate as a trusted authority (on the IIS machine)
Create certificate request , IIS to generate
Create IIS certificate
Install IIS certificate
Create request for client certificate
Create client certificate
Make client certificate into installable form (pkcs12)
Install client certificate to browser
-------------
Process : Create self signed Certificate Authority
Pre:
Openssl is in the search path
Directory structure
.\DemoCA\
.\DemoCA\serial <- file
.\DemoCA\index.txt <- file
.\DemoCA\Newcerts <- directory
In: CA.cnf file file can be a direct copy of the default openssl.cnf
Out:
Root.key
Root.pem
Method:
Create a self signed root cert.
Openssl req -new -x509 -keyout Root.key -out Root.pem -config
[pathtofile]\CA.cnf
Enter password
Verify password
Enter cert details
-----------------------
Process : Create an SSL certificate for installation on IIS
Pre: Self signed CA
In:
CA.cnf file can be a direct coyp of the default openssl.cnf
Root.key
Root.pem
Server.req (generate with IIS request util)
Out:
Server.crt
Server.pem
Method:
Sign the request with the CA certificate
Openssl ca -config [pathtofile]\CA.cnf -days 3650 -policy policy_anything
-cert Root.pem -keyfile Root.key -out Server.pem -infiles Server.req
Convert to a certificate IIS can install
Openssl x509 -in Server.pem -inform PEM -out Sever.crt -outform DES
-------------------------
Process: Create a client certificate for browser authentication
Pre: Self signed CA
In:
CAClient.cnf configuration file marked to create clients
authentication certs.
Root.key
Root.pem
Out:
Client.key
Client.req
Client.pem
Client.p12
Method:
Create a private key for the client browser
Openssl genrsa -des3 -out Client.key 1024
(enter password, verify password)
Create a request for the client against the private key
Openssl req -config [pathTofile]\CAClient.cnf -out Client.req -key
Client.key -new
Sign the request with the CA cert
Openssl ca -config [pathTofile]\CAClient.cnf -days 3650 -policy
policy_anything -cert Root.pem -keyfile Root.key -out Client.pem -infiles
Client.req
Make a pkcs12 form for import into browser
Openssl pkcs12 -in Client.pem -inkey Client.key -certfile Root.pem -out
Client.p12 -export -name "Client certificate"
--------------------------
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
