up vote 0 down vote favorite
1
share [g+] share [fb]

I was wondering if anyone has any idea in how to generate a signed CA cert and key using openssl? I have found this website (http://dev.mysql.com/doc/refman/5.1/en/secure-create-certs.html) to generate the client and server certs for mysql server but the example is a self-signed certificate. I use the following command for running the server and client using openssl and the generated certs and keys:

openssl s_server -accept 6502 -cert server-cert.pem -key server-key.pem -CAfile ca-cert.pem -www

openssl s_client -connect 192.168.1.92:6502 -cert client-cert.pem -key client-key.pem -CAfile ca-cert.pem

The error output I get is "Verify return code: 18 (self signed certificate)".

Paul

link|improve this question
This depends on wether you need "officially"/commercially signed certificates so that browsers don't complain of if rolling your own little CA will be sufficient. – SvenW Mar 7 '11 at 23:14
@SvenW, since he is talking about Mysql, I doubt the commercially signed point is relevant. – Zoredache Mar 7 '11 at 23:17
@user73483, have you considered using something like TinyCA instead of trying to generate the certs by hand? – Zoredache Mar 7 '11 at 23:18
I haven't consider TinyCA as I am running Windows. I have generate my own cert from cacert.org. To generate the CSR, I use the following website: lwithers.me.uk/articles/cacert.html but it gives an error "unable to verify the first certificate". I use the first link (MySQL) I posted to generate the server and client certs and keys. – user73483 Mar 8 '11 at 0:54
feedback

2 Answers

up vote 0 down vote
  • You can buy signed certificates from commercial providers out there.
  • You can use OpenCA
  • You can build your own Certificate Authority
  • You can use self-signed certificates as shown here: http://www.stunnel.org/?page=howto
link|improve this answer
feedback
up vote 0 down vote

I wrote a script last year to do all of it for me - creating a fake CA and signing the cert with that CA. Ensure you add the contents of ca.crt to the final PEM file if you need to have the chain intact.

http://tacticalvim.wordpress.com/2010/06/20/sslkeygen-sh-complete-ssl-cert-creation-helper-script/

Depending on it's use you'll still get CA issues with the fake signer, but it may technically work for your purpose.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.