[CentOS] Re: self signed ssl cert on C5

Thu Oct 25 18:54:19 UTC 2007
Tom Diehl <tdiehl at rogueind.com>

On Thu, 25 Oct 2007, Brian Mathis wrote:

> On 10/25/07, Tom Diehl <tdiehl at rogueind.com> wrote:
>> Hi,
>>
>> Does anyone have a pointer to correct documentation for generating and
>> installing a self signed ssl cert for use on httpd on a C-5 machine?
>>
>> The docs say to use genkey but AFAIK upstream rm'd crypto-utils from the
>> distro and as such it is not available. I tried generating the cert on a C-4
>> machine using genkey and installing on the C-5 machine but I get the following
>> error when I try to connect:
>>
>> [...]
>>
>> Can anyone tell me where I am going wrong here? Google is not being helpful
>> and I am getting frustrated. I wish I better understood open ssl. :-(
>>
>> Regards,
>>
>> --
>> Tom Diehl               tdiehl at rogueind.com             Spamtrap address mtd123 at rogueind.com
>
>
> You might find a bunch of guides online that give you ways to do it
> using openssl, but C5 has a Makefile already set up to do this for
> you.  Steps:
> 1. cd /etc/pki/tls/certs
> 2. make testcert
> 3. restart apache
>
> The default ssl.conf file points to the localhost.* files that are
> generated by this command.

Ok, So I changed the Makefile from localhost to match the actual hostname of
the machine. I then ran "make testcert" as suggested above and answered the
questions as appropriate. It then generated the cert without errors. I then
modified ssl.conf to point to the .key file and the .crt file, restarted apache.

Everything looked OK in the logs. I then pointed a browser at the machine and I
got the following errors in the ssl error log:

[Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1770): OpenSSL: Write: SSLv3 read client certificate B
[Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1789): OpenSSL: Exit: error in SSLv3 read client certificate B
[Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1789): OpenSSL: Exit: error in SSLv3 read client certificate B
[Thu Oct 25 14:31:25 2007] [info] [client 192.168.0.3] SSL library error 1 in handshake (server roadrunner.example.com:443)
[Thu Oct 25 14:31:25 2007] [info] SSL Library Error: 336105671 error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate No CAs known to server for verification?
[Thu Oct 25 14:31:25 2007] [info] [client 192.168.0.3] Connection closed to child 0 with abortive shutdown (server roadrunner.example.com:443)

In addition I catted the key and crt together to make a .pem and ran verify
on the cert. I got the following output:

(roadrunner pts1) # openssl verify roadrunner.example.com.pem
roadrunner.example.com.pem: /C=US/ST=Pennsylvania/L=Mytown/O=TN Techs LLC/CN=roadrunner.example.com/emailAddress=support at example.com
error 18 at 0 depth lookup:self signed certificate
OK
(roadrunner pts1) #

Am I correct that the above error is normal for a self signed cert?

Obviously I am missing something. Can anyone point me at a solution to this
problem?

Regards,

-- 
Tom Diehl		tdiehl at rogueind.com		Spamtrap address mtd123 at rogueind.com