I can't get OpenSSL to sign a certificate request

Randy

12/21/22, 3:10 PM

I am using OpenSSL 1.1.1k 25 Mar 2021 (source) on Windows 10. I am following this help page to try to get RabbitMQ to use tls.

'c:\OpenSSL\x64\bin' is part of my path.

My openssl.cnf file in the working directory:

[ ca ]
default_ca = testca

[ testca ]
dir = .
certificate = $dir/ca_certificate.pem
database = $dir/index.txt
new_certs_dir = $dir/certs
private_key = $dir/private/ca_private_key.pem
serial = $dir/serial

default_crl_days = 7
default_days = 365
default_md = sha256

policy = testca_policy
x509_extensions = certificate_extensions

[ testca_policy ]
commonName = supplied
stateOrProvinceName = optional
countryName = optional
emailAddress = optional
organizationName = optional
organizationalUnitName = optional
domainComponent = optional

[ certificate_extensions ]
basicConstraints = CA:false

[ req ]
default_bits = 2048
default_keyfile = ./private/ca_private_key.pem
default_md = sha256
prompt = yes
distinguished_name = root_ca_distinguished_name
x509_extensions = root_ca_extensions

[ root_ca_distinguished_name ]
commonName = hostname

[ root_ca_extensions ]
basicConstraints = CA:true
keyUsage = keyCertSign, cRLSign

[ client_ca_extensions ]
basicConstraints = CA:false
keyUsage = digitalSignature,keyEncipherment
extendedKeyUsage = 1.3.6.1.5.5.7.3.2

[ server_ca_extensions ]
basicConstraints = CA:false
keyUsage = digitalSignature,keyEncipherment
extendedKeyUsage = 1.3.6.1.5.5.7.3.1

Everything has worked up to this point. When I type ‘openssl ca -config openssl.cnf -in ..\server\req.pem -out server_certificate.pem -notext -batch -extensions server_ca_extensions -verbose’ I get nothing. No ‘server_certificate.pem’ anywhere I can find. No error messages either.

Any help diagnosing this will be appreciated.

UPDATE

I have now tried a different distribution (updating my path as well) with the same results. I have even tried replacing all / in openssl.cnf to \\.

110

1 + 2

openssl

windows-10

Michael Hampton

12/21/22, 3:46 PM

What happened when you ran that command?

Randy

12/21/22, 3:52 PM

@MichaelHampton Console prints 'Using configuration from openssl.cnf` and nothing else.

Score:0

Server

Randy

12/21/22, 5:58 PM

O.K. I applogize. This was my mistake. I created index.txt with notepad. What I needed to do was: copy nul index.txt. After that it all worked.

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: I can't get OpenSSL to sign a certificate request

TH: ฉันไม่สามารถรับ OpenSSL เพื่อลงนามคำขอใบรับรอง

RO: Nu pot solicita OpenSSL să semneze o cerere de certificat

RU: Я не могу заставить OpenSSL подписать запрос сертификата

VI: Tôi không thể yêu cầu OpenSSL ký yêu cầu chứng chỉ

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.