0

Getting this error with openssl 1.1.1d when using the CA generated as shown:

openssl req -new -x509 -config ca.cnf -newkey rsa:4096 -sha256 -nodes -out ca-certificate.pem -outform PEM
openssl req -new -config client.cnf -newkey rsa:2048 -sha256 -nodes -out client-certificate.csr -outform PEM
openssl ca -batch -config ca.cnf -policy signing_policy -extensions signing_req -out client-certificate.pem -infiles client-certificate.csr
openssl pkcs12 -export -in client-certificate.pem -inkey client-private-key.pem -password pass:xxx -chain -CAfile ca-certificate.pem -out client.p12 -name "Client Certificate"
Error invalid ca certificate getting chain

This works fine with v1.0.2. Please advise if there's a work-around.

L P
  • 101
  • 4
  • Please clarify your question, e.g. by adding the CA and client certificates (`openssl x509 -in -noout -text`). I can confirm certificate signing works with OpenSSL 1.1.1d, so there is something wrong in your procedure. – Piotr P. Karwasz Mar 28 '20 at 10:51
  • Is `client-certificate.pem` signed by the CA certificate? I suspect not as you haven't saved the CA's private key (which is required to sign) in the first step of your process. – garethTheRed Mar 28 '20 at 10:52
  • Edited for full commands used. If the ca.cnf is required, I can post that too. I left it out because it's quite big. – L P Mar 28 '20 at 11:11

0 Answers0