Subject: RE: Problems with creating own CA

From: "Long, Liesheng" <[email-masked]>
Date: Mon, 2 Dec 2002 16:15:35 -0500

Do ".csr" first, then do ".crt"

Try the following commands, add your path if needed:

1. openssl req -config openssl.cnf -new -key ca.key -out ca.csr
2. openssl x509 -extfile openssl.conf -days 365 -signkey ca.key \
			-in ca.csr -req -out ca.crt

-----Original Message-----
From: Sasa STUPAR [mailto:[email-masked]] 
Sent: Thursday, November 28, 2002 11:50 AM
To: [email-masked]
Subject: Re: Problems with creating own CA

One thing, if I try to use directly with the command "openssl req -new
-x509 -days 365 -key ca.key -out ca.crt" I get back error like before
with also that it canot load config info.
Any idea ?

Maurizio Marini a écrit:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Thursday 28 November 2002 05:01 pm, Sasa STUPAR wrote:
>  >They are already uncommented. Here is attached my config file.
> I've:
> commonName                      = Common Name (eg, your name or your
server\'s 
> hostname)
> commonName_max                  = 64
> commonName_default              = iris.dev.datalogica.com
> 
> it seems u lack this:
> commonName_default              = your_fqdn
> 
> - -- 
> Maurizio Marini			GSM +39-335-8259739
> Altamura: +39-080-3105228	Fax +39-080-3105228
> Pesaro: 	+39-0721-54277 	Fax +39-0721-415055
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> 
> iD8DBQE95kMq4Q/49nIJTlwRAi2VAJwLwvjSjLUXjj/x9L0I3PWLF6lRLQCfaTxG
> STINIYzTZ0FPIeYy3o5MKNg=
> =t8N+
> -----END PGP SIGNATURE-----
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
> 

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Sasa STUPAR <[email-masked]>
Date: Tue, 03 Dec 2002 14:50:08 +0100

Well, the thing is that just adding "...-config openssl.cnf..." was
enough. now it works.

Thanx

---

From: Sasa STUPAR <[email-masked]>
Date: Tue, 03 Dec 2002 15:22:07 +0100

OK, so creating a certifikate is done. How do I sign it ? I am using
windows but I have read in the documents to use sign.sh in mod-perl. Ok
but I am not having Linux anywhere near me. So what can I do ?

---

From: Maurizio Marini <[email-masked]>
Date: Tue, 3 Dec 2002 16:40:38 +0100

>but I am not having Linux anywhere near me. So what can I do ?

try a self-signed
openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout server.key -out server.crt

- -- 
Maurizio Marini

---

From: Sasa STUPAR <[email-masked]>
Date: Tue, 03 Dec 2002 19:37:45 +0100

Ok I have made a server certificate and a client certificate. I have
configured apache and ssl.conf with everything necesary BUT when I try
to conect to myserver:443 it tells me "connection has been refused".
Any idea ?

Maurizio Marini wrote:
> iD8DBQE97NB24Q/49nIJTlwRAu9MAJwP7waOwN/J2dYSzL4L9RkHNjpRrwCfTI65
> M0p49MjvotSa30mCfOFLL30=
> =P32L