I am attempting to create an IPSec VPN connection with x.509 cert authentication for users.
What follows is a test to get things going and isn't a secure implementation. I will get a certificate from a trusted source when I get this working, in the meantime I'm using a self-signed.
I'm on Windows 10 20H2
1- I create a root certificate with XCA.
2- I create a certificate signing request for, say, my first vpn user.
3- I sign the request with XCA
4- I export the request from XCA in PEM format
5- I install OpenSSL and set env variable OPENSSL_CONF to the openssl.cfg in the install folder. I used https://slproweb.com/products/Win32OpenSSL.html (64bit) for openSSL on W10
6- The fun begins.
To my understanding, I have to add the certificate in the windows machine through mmc in command line using the snap-in cert. addition wizard thingy. It doesn't accept pem format, it wants a crt.
I then refer to OpenSSL for conversion of the formats
When I type in x509 -in CERT.pem -out CERTII.crt
I get the following error:
Can't open CERT.pem for reading, No such file or directory 15732:error:02001002:system library:fopen:No such file or directory:crypto\bio\bss_file.c:69:fopen('CERT.pem','r') 15732:error:2006D080:BIO routines:BIO_new_file:no such file:crypto\bio\bss_file.c:76: unable to load certificate error in x509
I've searched quite a bit and can't find an exact meaning to this error and I'm contemplating pulling my hair out one by one as a viable alternative.
EDIT 2020-12-11 1600
renaming to .crt and adding to local certificates gave me an error:
file type is not recognizable. Select another file.
Also, even when specifying the full path in the openssl cli with admin priv., I get an error.
If, for example, I copy the cert into the OpenSSL folder, and attempt the command "openssl x509 -in CERT.pem -out CERT.crt", it gives me the following error:
"unable to load certificate 15252:error:0909006C:PEM routines:get_name:no start line:crypto\pem\pem_lib.c:745:Expecting: TRUSTED CERTIFICATE error in x509"
EDIT 2020-12-10 1610 - Snippet of the certificate
-----BEGIN CERTIFICATE REQUEST----- MIIDGjCCAgICAQAwgaExCzAJBgNVBAYTAkNBMQ8wDQYDVQQIEwZRVUVCRUMxEjAQ .... hfz1ew0RTMxZv2hMlN/wn5Y0EZKpRr5jMrgZprG7 -----END CERTIFICATE REQUEST-----
I am guessing it should not be listed as a request but as a signed certificate?
EDIT 2020-12-10 1626 EST
UnNamed solved my issue. a big shoutout to them.
in XCA, it's not immediately clear, when you sign a request, that it needs to be exported from a different tab, certificates.
Under the root cert used to sign the users certificate, is a dropdown with the SIGNED user cert. I was able to export it and add it to mmc without issue after creating a custom-view for certificates in it.
Continuing to setup the VPN from here.