On Thu, 25 Oct 2007, Brian Mathis wrote: > On 10/25/07, Tom Diehl <tdiehl at rogueind.com> wrote: >> Hi, >> >> Does anyone have a pointer to correct documentation for generating and >> installing a self signed ssl cert for use on httpd on a C-5 machine? >> >> The docs say to use genkey but AFAIK upstream rm'd crypto-utils from the >> distro and as such it is not available. I tried generating the cert on a C-4 >> machine using genkey and installing on the C-5 machine but I get the following >> error when I try to connect: >> >> [...] >> >> Can anyone tell me where I am going wrong here? Google is not being helpful >> and I am getting frustrated. I wish I better understood open ssl. :-( >> >> Regards, >> >> -- >> Tom Diehl tdiehl at rogueind.com Spamtrap address mtd123 at rogueind.com > > > You might find a bunch of guides online that give you ways to do it > using openssl, but C5 has a Makefile already set up to do this for > you. Steps: > 1. cd /etc/pki/tls/certs > 2. make testcert > 3. restart apache > > The default ssl.conf file points to the localhost.* files that are > generated by this command. Ok, So I changed the Makefile from localhost to match the actual hostname of the machine. I then ran "make testcert" as suggested above and answered the questions as appropriate. It then generated the cert without errors. I then modified ssl.conf to point to the .key file and the .crt file, restarted apache. Everything looked OK in the logs. I then pointed a browser at the machine and I got the following errors in the ssl error log: [Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1770): OpenSSL: Write: SSLv3 read client certificate B [Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1789): OpenSSL: Exit: error in SSLv3 read client certificate B [Thu Oct 25 14:31:25 2007] [debug] ssl_engine_kernel.c(1789): OpenSSL: Exit: error in SSLv3 read client certificate B [Thu Oct 25 14:31:25 2007] [info] [client 192.168.0.3] SSL library error 1 in handshake (server roadrunner.example.com:443) [Thu Oct 25 14:31:25 2007] [info] SSL Library Error: 336105671 error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate No CAs known to server for verification? [Thu Oct 25 14:31:25 2007] [info] [client 192.168.0.3] Connection closed to child 0 with abortive shutdown (server roadrunner.example.com:443) In addition I catted the key and crt together to make a .pem and ran verify on the cert. I got the following output: (roadrunner pts1) # openssl verify roadrunner.example.com.pem roadrunner.example.com.pem: /C=US/ST=Pennsylvania/L=Mytown/O=TN Techs LLC/CN=roadrunner.example.com/emailAddress=support at example.com error 18 at 0 depth lookup:self signed certificate OK (roadrunner pts1) # Am I correct that the above error is normal for a self signed cert? Obviously I am missing something. Can anyone point me at a solution to this problem? Regards, -- Tom Diehl tdiehl at rogueind.com Spamtrap address mtd123 at rogueind.com