Subject: autosigning certificate

From: Zampognaro Sergio <[email-masked]>
Date: Thu, 30 Jan 2003 11:46:57 +0100

Hi all,
I tried to use my own CA in order to sign the CSR previously produced.
Following what I got:

[naunx04:aspprod] /home/aspprod/aspapp/mySSL/openSSL/bin> ./sign.sh
server.csr
CA signing: server.csr -> server.crt:
Using configuration from ca.config
Enter pass phrase for ./ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'IT'
stateOrProvinceName   :PRINTABLE:'Napoli'
localityName          :PRINTABLE:'Pozzuoli'
organizationName      :PRINTABLE:'SchlumbergerSema'
organizationalUnitName:PRINTABLE:'EAI'
commonName            :PRINTABLE:'naunx04:8443'
emailAddress          :IA5STRING:[email-masked]'
Certificate is to be certified until Jan 29 17:29:55 2004 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
CA verifying: server.crt <-> CA cert
server.crt:
/C=IT/ST=Napoli/L=Pozzuoli/O=SchlumbergerSema/OU=EAI/CN=naunx04:8443/emailAd
dress=[email-masked]
error 18 at 0 depth lookup:self signed certificate
/C=IT/ST=Napoli/L=Pozzuoli/O=SchlumbergerSema/OU=EAI/CN=naunx04:8443/emailAd
dress=[email-masked]
error 7 at 0 depth lookup:certificate signature failure
[naunx04:aspprod] /home/aspprod/aspapp/mySSL/openSSL/bin>

I see 2 ERRORS:
error 18 at 0 depth lookup:self signed certificate
error 7 at 0 depth lookup:certificate signature failure

What they means? The certificate signing process is ok or not?

Many thanks.
Sergio.

> ________________________________________
>                                                          SchlumbergerSema
ing. Sergio Zampognaro
System Integration - SMA
Via Antiniana 2A - 80078 Pozzuoli (NA) - ITALY
> Mobile*+39 335 131 54 26
> Phone *  +39 081 6103 483
> Fax      6   +39 081 6103 200		
> e-mail *  [email-masked]
> 
This email is confidential and intended solely for the use of the individual
to whom it is addressed. Any views or opinions presented are solely those of
the author and do not necessarily represent those of SchlumbergerSema SpA.
If you are not the intended recipient, be advised that you have received
this email in error and that any use, dissemination, forwarding, printing,
or copying of this email is strictly prohibited.
If you have received this email in error please notify the SchlumbergerSema
Helpdesk, by telephone on +39.0125.810500 or by e-mail on
[email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Oleg Lyebyedyev" <[email-masked]>
Date: Thu, 30 Jan 2003 19:36:15 +0200

Hello all,

Is it possible to redirect user with bad cert to other page?
As I understand, server doesn't return any error code after ssl error on
expired cert. Therefore, ErrorDocument directive doesn,t work.

Thank You
Oleg Lebedev

---

From: Anbuchezhian <[email-masked]>
Date: Thu, 30 Jan 2003 23:35:26 +0530

Hello All,

Please provide your thoughts on the problem I am facing.

We use Apache 1.3.27 , mod_ssl 2.8.12 and OpenSSL 0.9.6h[engine]. The
[engine] version is used because we use nCipher card as the hardware
accelerator.  The error that is baffling is:

 ./apachectl startssl
./apachectl startssl: httpd could not be started

ssl_engine_log :
[30/Jan/2003 08:12:23 01657] [error] Init: Failed to enable Crypto Device
API `chil'

error_log:
[Thu Jan 30 08:12:23 2003] [error] mod_ssl: Init: Failed to enable Crypto
Device API `chil

I do not have much idea on this. Hence I request you to me atleast some
pointers.

Thanks in advance,
Anbu

---

From: Geoff Thorpe <[email-masked]>
Date: Thu, 30 Jan 2003 13:42:23 -0500

> I do not have much idea on this. Hence I request you to me atleast some

Try changing the SSLLogLevel directive to spit out more information. As
apache is stopping virtually immediately, you could probaby afford to
set "SSLLogLevel debug".

Anyway, that should probably dump the OpenSSL errors to the log too,
which I believe will give you more clue as to the problem (most likely
the nCipher-specific shared-library that openssl tries to load couldn't
be found).

Cheers,
Geoff

-- 
Geoff Thorpe
[email-masked]
http://www.geoffthorpe.net/

---

From: Aihong Yin <[email-masked]>
Date: Fri, 31 Jan 2003 18:00:59 +0100

Hello Zampognaro,

>What they means? The certificate signing process is ok or not?
The certificate signing process is not ok!
Are you using openssl-2.9.6g? Please try it again with openssl-2.9.7.

I hope this mail is not too late for you!

Cheers,
Aihong Yin.