On Nov 17, 2004, at 1:01 PM, Dr. Stephen Henson wrote:
On Wed, Nov 17, 2004, Dan O'Brien wrote:
Hi,
We're trying to generate a Certificate Authority on our Debian/Apachessl server. Here's the command we're entering:
openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 7000
The above command kicks back the following error:
unable to find 'distinguished_name' in config
problems making Certificate Request
290:error:0E06D06A:configuration file routines:NCONF_get_string:no conf
or environment variable:conf_lib.c:343:
We checked the openssl FAQ and discovered this:
+++++ DIAGNOSTICS
The following messages are frequently asked about: Using configuration from /some/path/openssl.cnf Unable to load config info
This is followed some time later by... unable to find 'distinguished_name' in config problems making Certificate Request
The first error message is the clue: it can't find the configuration file! Certain operations (like examining a certificate request) don't need a configuration file so its use isn't enforced. Generation of certificates or requests however does need a configuration file. This could be regarded as a bug.
Another puzzling message is this: Attributes: a0:00
this is displayed when no attributes are present and the request includes the correct empty SET OF structure (the DER encoding of which is 0xa0 0x00). If you just see: Attributes:
then the SET OF is missing and the encoding is technically invalid (but it is tolerated). See the description of the command line option -asn1-kludge for more information. +++++
We then followed the lead to this info about -asn1-kludge:
The lead isn't asn1-kludge, that's something entirely different.
The hint is the bit where it talks about being unable to find the configuration file.
Do you get an error about being unable to find the configuration file before
the one you mentioned?
Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Hi Steve, thanks for the response. We did not get this error (or if we have, we haven't seen it):
Using configuration from /some/path/openssl.cnf
Unable to load config infoBut we did get this error upon attempting to make a CA:
unable to find 'distinguished_name' in config
problems making Certificate Request- Dan O'Brien
______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
