#edit \/etc\/ssl\/openssl.cnf<\/p>\n
Find [ ca ] and make sure this matches:<\/p>\n
#################################################################### \r\n[ ca ] \r\ndefault_ca \u00a0\u00a0\u00a0\u00a0\u00a0= CA_default #default ca section \r\n\r\n#################################################################### \r\n\r\n[ CA_default ] \r\n\r\ndir \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0= \/etc\/ssl \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Where everything is kept \r\ncerts \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0= $dir\/certs \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Where the issued certs are kept \r\ncrl_dir \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0= $dir\/crl \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Where the issued crl are kept \r\ndatabase \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0= $dir\/index.txt \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# database index file. \r\n#unique_subject = no \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Set to 'no' to allow creation of \r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# several certs with same subject. \r\nnew_certs_dir \u00a0\u00a0= $dir\/newcerts \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# default place for new certs. \r\n\r\ncertificate \u00a0\u00a0\u00a0\u00a0= $dir\/cacert.pem \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# The CA certificate \r\nserial \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0= $dir\/serial \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# The current serial number \r\ncrlnumber \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0= $dir\/crlnumber \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# the current crl number \r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# must be commented out to leave a V1 CRL \r\ncrl \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0= $dir\/crl.pem \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# The current CRL \r\nprivate_key \u00a0\u00a0\u00a0\u00a0= $dir\/private\/cakey.pem# The private key \r\nemail_in_dn \u00a0\u00a0\u00a0= no \r\nserial \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0= $dir\/serial \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# serial no file \r\nrand_serial \u00a0\u00a0\u00a0= yes \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# for random serial#'s\r\n\r\n<\/pre>\nI generated a CA with<\/p>\n
openssl genrsa -aes256 -out root_ca_key 16384 \r\nopenssl req -x509 -new -nodes -key root_ca_key -sha3-512 -days 3650 -out root_ca.crt<\/pre>\nThen did a cert signing request with (needs write permissions to various \/etc\/ssl\/ directories)<\/p>\n
openssl ca -extensions v3_ca -days 3650 -notext -md sha3-512 -cert root_ca.crt -keyfile root_ca_key -in intermediate_ca.csr -out intermediate_ca.cer -outdir \/home\/grassyloki\/openssl\/<\/pre>\nNote: Country Name, State or Province Name, Locality Name, and Organization Name all need to match. Make sure to change the home folder to match your username.<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"