4
votes

I am trying to sign my CSR file with my CA.

I am using the following command :

openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf

My openssl.cnf has not been altered and it is at its default state.

Please refer to pic below:

enter image description here

2
Looks like a permission issue. Can you try giving access to newcerts directory?Jay
Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See What topics can I ask about here in the Help Center. Perhaps Super User or Unix & Linux Stack Exchange would be a better place to ask. Also see Where do I post questions about Dev Ops?jww
czifro is correct. The ./demoCA is specified in the openssl.cnf fileBarryPye

2 Answers

2
votes

When this command is run in the demoCA folder, and it is looking for newcerts folder, it should just search for newcerts, but is instead searching for ./demoCA/newcerts, even though it is already in the newcerts folder! I don't know why...

To fix this, I moved up a folder (out of the demoCA folder, and into whatever folder is holding your demoCA folder), then changed the command so that all the files have ./demoCA in front of them:

openssl ca -in ./demoCA/server.csr -out ./demoCA/server.crt -cert ./demoCA/ca.crt -keyfile ./demoCA/ca.key -config ./demoCA/openssl.cnf

Then it finally worked for me!!

(A better way to fix the issue would be to figure out why it is searching for ./demoCA/newcerts instead of simply newcerts, but I couldn't figure it out.)

1
votes

Modifying permissions is an easy test to see if you are targeting the wrong location. For kicks and grins try your overriding the out location to the same location you are working with, like this:

openssl ca -in server.csr -out ~/demoCA/server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf