3
I am trying to use a Root CA to sign a CSR for an Intermediate certificate and OpenSSL asks for my password and then after that nothing happens. No error message and no certificates are made. The command it is failing on is:
openssl ca -config rootca.cnf -extensions v3_intermediate_ca ^
-days 730 -notext -md sha256 ^
-in C:/Certificates/IntermediateCA/csr/intermediate.csr.pem ^
-out C:/Certificates/IntermediateCA/public/intermediate.cert.pem
openssl responds with:
Enter pass phrase for C:/Certificates/RootCA/private/rootca.key.pem:
and when I enter the password, nothing happens after that.
A good answer to this question would have two parts:
- What am I doing wrong?
- How can I get error output for this issue?
Additional Details
Not sure if this is needed but here are some additional commands I am using to generate the rest of the Intermediate CA:
Creating Intermediate CA private key:
openssl genrsa -aes256 -out private/intermediate.key.pem 4096
Creating Intermediate CSR:
openssl req -config intermediateca.cnf -new -sha256 ^
-key private/intermediate.key.pem ^
-out csr/intermediate.csr.pem
rootca.cnf (the important parts):
[ CA_default ]
dir = C:/Certificates/RootCA
...
[ policy_strict ]
countryName = match
stateOrProvinceName = match
localityName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
...
[ req_distinguished_name ]
0.organizationName_default = org1
1.organizationName_default = org1.1
...
[ v3_intermediate_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
Can you access the directory
C:/Certificates/RootCA/private
? Can you read the fileC:/Certificates/RootCA/private/rootca.key.pem
with the user you are running the openssl with? Last idea, is the password correct (aren't there any special characters in the way?) – tukan – 2018-06-10T11:07:19.720Yes, you can read all the files, I used an OpenSSL check to confirm that the private key was correct (with the password) – Kyle B – 2018-06-11T11:42:30.093
Could you check it with process explorer or procmon (both from Sysinternals) to see if the file
rootca.key.pem
is accessed/read. Second thing that comes into my mind is the file could have different lines end -> windows(EOL -> crlf) vs. linux (lf). – tukan – 2018-06-12T16:21:12.917