> From: [email protected] On Behalf Of hdf sdesdh > Sent: Saturday, 09 May, 2009 17:47
> I want to generate encrypted private keys for my openvpn > server/clients, so I'm using the scripts bundled with it. > For some reason, I can't get it to generate encrypted CA > keys. This is my script: > Your problem is not generating, or encrypting, the CA keypair (you need only one pair); that worked fine. Your problem is getting a cert for that keypair, which is necessary for it to be of use in most cases. (Not absolutely all; there are other ways to deploy trust roots than selfsigned certs.) > @echo off > cd %HOME% > openssl req -days 1097 -sha1 -new -keyout > D:\\OpenVPN\\easy-rsa\\keys\\%1.key -out > D:\\OpenVPN\\easy-rsa\\keys\\%1.csr -config %KEY_CONFIG% (those three lines were one and so were the next, but Microsoft "improved" Outlook again and it quotes wrong, sorry) > openssl ca -days 1097 -md sha1 -out > D:\\OpenVPN\\easy-rsa\\keys\\%1.crt -in > D:\\OpenVPN\\easy-rsa\\keys\\%1.csr -config %KEY_CONFIG% > > It seems to fail at the second line. After generating the > key, I am prompted for the password a second time, and that's > when it fails. I don't know why it says ca.crt not found, > when that is what it is supposed to be generating. <snip> req -new without -x509 generates a CSR, not a cert. Which is consistent with the names (extensions) used. But that's useless; openssl won't 'grant' (issue a cert for) the request without a signing cert, which you don't have. Although there are a few possible options, the simplest is to generate a selfsigned root CA cert in ONE step: openssl req -new -x509 -config file -out ca.crt [-keyout ca.key] (-keyout is not needed if set in the config file; -sha1 is now default; add -days N if you want more than 30 and you usually do.) Then for each *entity* generate keypair+CSR with req -new NOT -x509, and process CSR to issue cert with ca. For CSRs processed by ca, you can set days and digest in the config file. Be sure you have 'database' and serial files needed by ca, as discussed recently in "index.txt: library:fopen:No such file or directory ..." Note you don't need to double backslashes in Windows CMD, including .BAT scripts. (If you were using a shell port, like mingw/cygwin, that might be different.) Actually you can use forward slashes instead of backslashes to openssl -- but not to CMD builtins and many Windows programs, and it's usually too much hassle to remember when to switch. You could also put the directory-path in an envvar, which makes the command(s) shorter and easier to work on. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
