0

I am attempting to create an IPSec VPN connection with x.509 cert authentication for users.

What follows is a test to get things going and isn't a secure implementation. I will get a certificate from a trusted source when I get this working, in the meantime I'm using a self-signed.

I'm on Windows 10 20H2

1- I create a root certificate with XCA.

2- I create a certificate signing request for, say, my first vpn user.

3- I sign the request with XCA

4- I export the request from XCA in PEM format

5- I install OpenSSL and set env variable OPENSSL_CONF to the openssl.cfg in the install folder. I used https://slproweb.com/products/Win32OpenSSL.html (64bit) for openSSL on W10

6- The fun begins.

To my understanding, I have to add the certificate in the windows machine through mmc in command line using the snap-in cert. addition wizard thingy. It doesn't accept pem format, it wants a crt.

I then refer to OpenSSL for conversion of the formats

When I type in x509 -in CERT.pem -out CERTII.crt

I get the following error:

Can't open CERT.pem for reading, No such file or directory
15732:error:02001002:system library:fopen:No such file or directory:crypto\bio\bss_file.c:69:fopen('CERT.pem','r')
15732:error:2006D080:BIO routines:BIO_new_file:no such file:crypto\bio\bss_file.c:76:
unable to load certificate
error in x509

I've searched quite a bit and can't find an exact meaning to this error and I'm contemplating pulling my hair out one by one as a viable alternative.

EDIT 2020-12-11 1600

renaming to .crt and adding to local certificates gave me an error:

file type is not recognizable. Select another file.

Also, even when specifying the full path in the openssl cli with admin priv., I get an error.

If, for example, I copy the cert into the OpenSSL folder, and attempt the command "openssl x509 -in CERT.pem -out CERT.crt", it gives me the following error:

"unable to load certificate
15252:error:0909006C:PEM routines:get_name:no start line:crypto\pem\pem_lib.c:745:Expecting: TRUSTED CERTIFICATE
error in x509"

EDIT 2020-12-10 1610 - Snippet of the certificate

-----BEGIN CERTIFICATE REQUEST-----
MIIDGjCCAgICAQAwgaExCzAJBgNVBAYTAkNBMQ8wDQYDVQQIEwZRVUVCRUMxEjAQ
....
hfz1ew0RTMxZv2hMlN/wn5Y0EZKpRr5jMrgZprG7
-----END CERTIFICATE REQUEST-----

I am guessing it should not be listed as a request but as a signed certificate?

EDIT 2020-12-10 1626 EST

UnNamed solved my issue. a big shoutout to them.

in XCA, it's not immediately clear, when you sign a request, that it needs to be exported from a different tab, certificates.

Under the root cert used to sign the users certificate, is a dropdown with the SIGNED user cert. I was able to export it and add it to mmc without issue after creating a custom-view for certificates in it.

Continuing to setup the VPN from here.

Improve this question
8
  • Can you show us a snippet of the content of the file?
    – unNamed
    Dec 11, 2020 at 21:05
  • UnNamed, thanks again for replying. the snippet has been added as an edit
    – S4M8
    Dec 11, 2020 at 21:11
  • What you have is a certificate signing request (csr). This contains the public key of the future signed certificate which is not yet signed. Therefore you get an error trying to import it as certificate. You need to sign/self-sign it first.
    – unNamed
    Dec 11, 2020 at 21:17
  • its listed as signed in XCA. i did sign it I am sure. let me reverify.
    – S4M8
    Dec 11, 2020 at 21:20
  • I'm an idiot. I was exporting the request and not the signed one. S H A M E O N M E XD
    – S4M8
    Dec 11, 2020 at 21:22

1 Answer 1

Reset to default
0

The certificate needs to be in the same directory as the openssl.exe or specify the full/absolute path like C:\temp\cert.pem.

The crt file extension is for Windows, the content is base64 PEM format. No need to "convert" the content. Just rename the file extension from .pem to .crt.

Improve this answer
1
  • Thanks a lot for your answer! I tried to no avail unfortunately, but I will keep working on this until I get it. Could it be a certificate generation error? Or CSR signing error?
    – S4M8
    Dec 11, 2020 at 21:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .