SSL certificates generated by SelfSSL7 are failing. Any ideas?

Question

I have a web server (used for testing) to which i have assigned 3 IP addresses. The goal is to have 3 SSL protected websites.

I have used the selfSSL7.exe tool to generate the certificates:

selfssl7 /N cn=app.test.local /v 3650 /Q /T /X /F app.test.local.pfx /W password
selfssl7 /N cn=api.test.local /v 3650 /Q /T /X /F api.test.local.pfx /W password
selfssl7 /N cn=www.test.local /v 3650 /Q /T /X /F www.test.local.pfx /W password

This installs the certificates automatically into the users personal certificate store ("MY") and their trusted root certification authorities store ("root).

To be certain that there are no artifacts from previous attempts I firstly run:

certutil –delstore MY app.test.local
certutil –delstore root app.test.local
etc... for the other sites.

which removes the certificates from the 2 stores in questions.

My problem is that when I run:

certutil -store my OR certutil -store root

to verify that the certificates are alright, 2 of my new certificates (not all 3!) show the following error:

ERROR: Certificate public key does NOT match stored keyset

I don't understand why this could be the case. Any ideas?

UPDATE:

I have noticed that as I step through applying the 3 certificates, the last certificate applied is fine and any previous certificates are invalidated. I have also noticed that all of the certificates have the same "Unique Container Name". Could this be causing my problem? I wonder if there is away of fixing this in SelfSSL7?

The full output is below:

================ Certificate 2 ================
Serial Number: 152ac3a087bf4db944a57aae15b1567e
Issuer: CN=www.test.local
 NotBefore: 30/09/2011 10:56 AM
 NotAfter: 27/09/2021 10:00 AM
Subject: CN=www.test.local
Signature matches Public Key
Root Certificate: Subject matches Issuer
Template:
Cert Hash(sha1): 7f 6f e3 07 5d 29 e0 e7 24 4a 32 75 39 27 5c 71 ed 0f d6 e1
  Key Container = my
  Unique container name: 85c14c8bb87418bd9929adba2a9e9412_2259fcf6-b658-4ba5-aac3-35980c9148c2
  Provider = Microsoft RSA SChannel Cryptographic Provider

Certificate Public Key:
Version: 3
Public Key Algorithm:
    Algorithm ObjectId: 1.2.840.113549.1.1.1 RSA (RSA_SIGN)
    Algorithm Parameters:
    05 00
Public Key Length: 1024 bits
Public Key: UnusedBits = 0
    0000  30 81 89 02 81 81 00 c2  00 ed 38 1b 8d 01 16 3f
    0010  84 d2 97 7f 89 81 3f 19  c9 6b 8f d4 25 85 5d c8
    0020  89 b7 46 de 4a 1e 4f b1  6f ae 89 02 15 53 7d 04
    0030  d4 a6 98 7e 76 4b fc 31  02 3e 47 40 a3 d4 f6 6c
    0040  8b 24 ab ff 26 d1 46 c8  1a c2 6c 67 b6 30 91 f8
    0050  68 6f 95 c5 30 1a 38 49  77 6b 04 b7 8e 75 2e 8d
    0060  2f 70 85 65 6d 87 3e 6b  4c 4c f5 51 26 44 8c 77
    0070  51 dc e0 05 1d 48 9e 00  60 0e 45 19 ff 6f 44 77
    0080  c2 ec 75 50 58 05 b1 02  03 01 00 01
Key Id Hash(rfc-sha1): 70 2f c9 e6 90 cb 24 97 94 b9 ae 22 ca 17 08 04 8e a4 e9
c6
Key Id Hash(sha1): c2 83 14 50 76 18 5b 89 f6 f8 e3 7c 1e 93 68 bb d9 9e d6 26

Container Public Key:
Public Key Algorithm:
    Algorithm ObjectId: 1.2.840.113549.1.1.1 RSA (RSA_SIGN)
    Algorithm Parameters: NULL
Public Key Length: 1024 bits
Public Key: UnusedBits = 0
    0000  30 81 89 02 81 81 00 af  d3 6d e1 ac b7 f0 8a 9b
    0010  fd eb 99 08 73 e1 f7 9c  41 a5 51 82 a5 f8 f7 93
    0020  a8 0f 74 d6 74 a9 04 3e  1a d9 a6 7c 56 01 a0 e2
    0030  2d 92 ec c5 13 c9 0e c7  27 79 3c 5d 4d 31 e4 0e
    0040  0c 13 0e d0 b1 9d 2d 4d  8f c9 e8 8a 89 5b 9c 97
    0050  9f 38 6e 02 f1 19 7c 6a  4a db e9 b6 d0 80 b7 d8
    0060  ce a1 a3 13 3f e3 50 95  8e 02 75 73 94 5e 84 ed
    0070  36 17 a5 c4 50 c2 23 bb  22 dc fd 39 57 ed bd f0
    0080  9e eb da 15 d7 87 9d 02  03 01 00 01
Key Id Hash(rfc-sha1): 08 f4 65 d7 00 06 bb cd bb 37 1b e9 7d 48 17 18 cb 35 30
6d
Key Id Hash(sha1): 03 45 68 3a 1d 60 a1 d6 f6 5b 34 98 23 b1 50 11 d6 2d 4e bd

ERROR: Certificate public key does NOT match stored keyset
Encryption test FAILED

score 3 · Accepted Answer · answered Oct 03 '11 at 23:29

Instead of using SelfSSL7, I tried using the internal "makecert" tool and I didn't have any problems with the certificates it generated.

This is the command to create a certificate, install it only to the "MY" (Personal) certificate store on the current machine, and also output it to a CER file for use on other machines.

The makecert utility for me was found at C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\x64

makecert.exe -r -pe -a SHA256 -ss my -sr LocalMachine -n "CN="app.test.local -b 01/01/2011 -e 01/01/2050 -eku 1.3.6.1.5.5.7.3.1 -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 app.test.local.cer

Hope that helps someone.

score 2 · Answer 2 · answered Feb 12 '14 at 21:46

I have noticed that as I step through applying the 3 certificates, the last certificate applied is fine and any previous certificates are invalidated. I have also noticed that all of the certificates have the same "Unique Container Name". Could this be causing my problem?

I think you've hit the nail on the head here. The "unique container name" is the filename of a "key container" located at C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys. As far as I can tell, a key container is a wrapper for a public/private key. You can inspect the files in this folder as you run SelfSSL, and you will see that the modified date for the file corresponding to the "unique container name" updates every time you run SelfSSL. (BTW, opening this file with a text editor will let you see the logical name of the container, in this case it is "SELFSSL".

So SelfSSL seems to be written to re-use the same key container every time it is run, which would mean creating a new public/private key. I think that the implication is that any public key left hanging around after SelfSSL has been run again has no private key (it may think it has a private key, but the key container no longer has its cryptographically corresponding private key.

In my case, this is leading to all HTTPS requests to a site bound to those previous certificates to fail with a server connection reset. Inside the event viewer I'm seeing "A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 20. The Windows SChannel error state is 960."

(I'm using SelfSSL, but it seems to be the same problem as you're seeing with SelfSSL7)

SSL certificates generated by SelfSSL7 are failing. Any ideas?

2 Answers2