I have the root certificate pem file from a Linux server. The application that needs to connect to that server is telling me it needs a publicCert pem file and a privateKey pem file to communicate with the server.

My understanding is the root cert I currently have can then generate "n" number of certificates as intermediates. Problem is that I'm struggling to get openssl to do what I want, so my question is how do I generate these exactly? My thought is that I would feed openssl the path to the root cert and then it would dump out the publicCert/privateKey I want.

I've created the certs on the server as described here. Now I need to install on the downstream device as described here.

The input of client connection I need to use requires these parameters:

connString: 'HostName=foo'
protocol: MQTT
publicKeyCertificateString: certificateString or path to certificate
privateKeyString: keyString or path to key

new DeviceClient(connString, protocol, publicKeyCertificateString, privateKeyString);
  • I'm on OSX
  • Cert format: pem
  • Authentication: x509
  • Where did the root CA cert come from? Is this a CA that you manage, or is it one of the 3rd party root CA's, like Verisign, AddTrust, DigiCert, etc? If you don't own the private key for the CA cert, you'll never be able to generate certificates using it. – guzzijason Sep 22 '18 at 1:59
  • @guzzijason The certificate was generated on the server. It's not a CA, just device-to-device. I need to connect an Android device to an IoT gateway. – Phil Andrews Sep 24 '18 at 16:57

Unless you run the root certificate authority (CA), you cannot generate any certificates with the root certificate. What you have are probably the root "public" certificates, and not the "private" keys, which are controlled by the CA. You can only generate intermediate certs with the root private key.

If you could do what you are suggesting, then anyone in the world would be able to generate certificates themselves, that are chained to the trusted root CA, which defeats the purpose of a root CA.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.