Dotaz: OpenSSL 0.9.6l , 0.9.7g

[Lachmex]

Dobry den vsem, mam nasledujici problemek (na obou ver. to dela totez): login as: root
Linux 2.6.11.
root@master:~# cd /usr/local/ssl/
root@xxx:/usr/local/ssl# misc/CA.sh -newca
CA certificate filename (or enter to create)

Making CA certificate ...
Using configuration from /usr/local/ssl/openssl.cnf
Generating a 1024 bit RSA private key
........++++++
......................................................................................++++++
writing new private key
to './demoCA/private/./cakey.pem'

Enter PEM pass phrase:
Enter PEM pass phrase:
Enter PEM pass phrase:
Enter PEM pass phrase:
13250:error:0906406D:PEM routines:DEF_CALLBACK:problems
getting password:pem_lib.c:114: 13250:error:0906906F:PEM routines:PEM_ASN1_write_bio:read key:pem_lib.c:367:
root@master:/usr/local/ssl#


a tak to dopadne vzdy...
Prosim P O M O O O C !

Dekuji :)

Odpovědi

[goldenfish]

neco malo z man CA.

-verbose - vetsi vypis chyb aplikace

a pravdepodobna chyba, ze mate jinde konfigurak nez to aplikace ocekava -config /etc/ssl/openssl.conf(ci jine umisteni). predpokladam, ze konfigurak mate zeditovany podle potreb na CA a certifikat.

-- anebo zkusit tinyca. graficky a na zacatek lepsi.

bye gf

[Lachmex]

Tak jsem to vzresil trochu jinak :)
#!/bin/bash
echo -n "Enter name of server (DN):"
read servername

if [ -z "$servername" ]; then
echo "Sorry, but no valid name entered!"
exit
fi

echo "Getting server certificate for DN $servername..."

openssl req -new -nodes -out $servername.csr -keyout $servername.priv.key
openssl rsa -in $servername.priv.key -out $servername.key
openssl x509 -in $servername.csr -out $servername.crt -req -signkey $servername.key -days 1825
openssl x509 -in $servername.crt -out $servername.der -outform DER

echo "Saving certs into right places..."

cp $servername.crt /usr/local/apache/certs
cp $servername.key /usr/local/apache/certs
cp $servername.der /usr/local/apache/certs

mv $servername.priv.key /usr/local/ssl/private
mv $servername.* /usr/local/ssl/certs

echo "Done."

Toto mi funguje. Nicmene budu rad, kdyz mi na to sdelite nazor, pokus to neni "ciste"...

[goldenfish]

pridal bych jeste osetreni prav na soubory vygenerovanych certifikatu. nejake chmod.

nicmene, ale nechapu jednu vec. patrne mate mozna v dane problematice trochu zmatek. chapu, neni to jednoduche.

predtim jste spoustel skript na vytvoreni CA. a vas skript generuje serverovy certifikat a requesty. zasadni vec je to, co chcete vytvorit.

bye gf

[goldenfish]

zasilam kus sveho skriptu, co mam na generovani certifikatu. nevim, zda uplne chodi. nezkousel jsem nejaky mesic a apache uz ted moc nepouzivam. je to na self-signed certifikaty. patrne nemate podepsany certifikat od verisignu ci jine overene autority.

berte to spise pro kontrolu.

doplnte si pripadne konfigurak pro openssl.

#:/bin/bash
  
echo "Certificate generator";
 
cd /etc/ssl/your_nameCA/
 
# necisty zapis do database
echo > index.txt
## zde je treba generovat cisla certifikatu, ne fix
echo 01 > serial
 
echo "Create CA key with XXXX bit";
 
mkdir -pv CA
 
openssl genrsa -out CA/your_nameCA.key \
  	#		-config /etc/ssl/openssl.conf

echo "Create Certificate Request";

 openssl req -new -key CA/your_nameCA.key -out CA/your_nameCA.csr \
 		-config /etc/ssl/openssl.conf

echo "Self-sign certificate";

openssl x509 -req -days 15 -in CA/your_nameCA.csr \
 -out CA/your_nameCA.crt -signkey CA/your_nameCA.key

openssl x509 -in CA/your_nameCA.crt -text

echo "Creating the webserver certificate";
 
mkdir -v server
mkdir -v server/certificates
mkdir -v server/requests
mkdir -v server/keys

echo "Generating the webservers key"
cd server/

openssl genrsa -des3 -out keys/your_nameWEB.key \
	#	-config /etc/ssl/openssl.conf

echo "Generating the webservers certificate request";

openssl req -new -key keys/your_nameWEB.key \
 -out requests/your_nameWEB.csr -config /etc/ssl/openssl.conf
 

echo "Sign the webservers certificate request with the CA key";


openssl ca -in requests/your_nameWEB.csr -cert ../CA/your_nameCA.crt -keyfile \
 ../CA/your_nameCA.key -out certificates/your_nameWEB.crt

echo "check the generated certificate";

openssl x509 -in certificates/your_nameWEB.crt -text


echo "all may be generated";

bye gf