<div dir="ltr"><div>Sorry I left out half of my message. I created from CA down. As listed below.<br><br><span lang="EN"><br><p>### Options fed into certs</p>
<p>## Country Name (2 letter code) [XX]:US</p>
<p>## State or Province Name (full name) []:STATE</p>
<p>## Locality Name (eg, city) [Default City]:City</p>
<p>## Organization Name (eg, company) [Default Company Ltd]:Company</p>
<p>## Organizational Unit Name (eg, section) []:Section</p>
<p>## Common Name (eg, your name or your server's hostname) []:<a href="http://host.local.com">host.local.com</a></p>
<p>## Email Address []:</p>
<p> </p>
<p># Create private key for CA</p>
<p>openssl genrsa -out HOME_Root_CA.key 2048</p>
<p># Create CA certificate</p>
<p>openssl req -x509 -new -nodes -key HOME_Root_CA.key -sha256 -days 3650 -out HOME_Root_CA.pem</p>
<p># Review ticket just created</p>
<p>openssl x509 -in HOME_Root_CA.pem -noout -text</p>
<p> </p>
<p># Create private key for Client</p>
<p>openssl genrsa -out HOME_Client.key 2048</p>
<p># Create Certificate Signing Request (.csr)</p>
<p>openssl req -new -key HOME_Client.key -out HOME_Client.csr</p>
<p># Generate client certficate based on CA</p>
<p>openssl x509 -req -in HOME_Client.csr -CA HOME_Root_CA.pem -CAkey HOME_Root_CA.key -CAcreateserial -out HOME_Client.pem -days 3650 -sha256</p>
<p> </p>
<p># Create Personal Information Exchange (pfx) cert </p>
<p>openssl pkcs12 -export -in HOME_Client.pem -inkey HOME_Client.key -out HOME-client-cert.pfx<span></span></p></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 15, 2017 at 9:24 AM, Richard Olsen <span dir="ltr"><<a href="mailto:rolsen@quotient-inc.com" target="_blank">rolsen@quotient-inc.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="m_4010672446806394711gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><span lang="EN"><p>I've run out of ideas on this and hope someone here can help me. I'm trying to set up SSL with self signed certificates. I'm on RHEL6 with httpd 2.2.15-60.el6.9_5 using firefox browser. I've created the certs with the following code:</p>
<p> </p>
<p>[CODE]</p>
<p>### Options fed into certs</p>
<p>## Country Name (2 letter code) [XX]:US</p>
<p>## State or Province Name (full name) []:STATE</p>
<p>## Locality Name (eg, city) [Default City]:City</p>
<p>## Organization Name (eg, company) [Default Company Ltd]:Company</p>
<p>## Organizational Unit Name (eg, section) []:Section</p>
<p>## Common Name (eg, your name or your server's hostname) []:<a href="http://host.local.com" target="_blank">host.local.com</a></p>
<p>## Email Address []:</p>
<p> </p>
<p># Create private key for CA</p>
<p>openssl genrsa -out HOME_Root_CA.key 2048</p>
<p># Create CA certificate</p>
<p>openssl req -x509 -new -nodes -key HOME_Root_CA.key -sha256 -days 3650 -out HOME_Root_CA.pem</p>
<p># Review ticket just created</p>
<p>openssl x509 -in HOME_Root_CA.pem -noout -text</p>
<p> </p>
<p># Create private key for Server</p>
<p>openssl genrsa -out HOME_Server.key 2048</p>
<p># Create CA certificate</p>
<p>openssl req -x509 -new -nodes -key HOME_Server.key -sha256 -days 3650 -out HOME_Server.pem</p>
<p># Review ticket just created</p>
<p>openssl x509 -in HOME_Server.pem -noout -text</p>
<p> </p>
<p># Create private key for Client</p>
<p>openssl genrsa -out HOME_Client.key 2048</p>
<p># Create Certificate Signing Request (.csr)</p>
<p>openssl req -new -key HOME_Client.key -out HOME_Client.csr</p>
<p># Generate client certficate based on CA</p>
<p>openssl x509 -req -in HOME_Client.csr -CA HOME_Root_CA.pem -CAkey HOME_Root_CA.key -CAcreateserial -out HOME_Client.pem -days 3650 -sha256</p>
<p>[/CODE]</p>
<p> </p>
<p>Then I tried to create a client cert i can import in the browser and be authenticated.</p>
<p> </p>
<p>[CODE]</p>
<p># Create Personal Information Exchange (pfx) cert </p>
<p>openssl pkcs12 -export -in HOME_Client.pem -inkey HOME_Client.key -out HOME-client-cert.pfx</p>
<p> </p>
<p>[/CODE]</p>
<p> </p>
<p>My ssl config file in /etc/httpd/conf.d/home-test.<wbr>conf</p>
<p> </p>
<p>[CODE]</p>
<p>Listen 443</p>
<p>LoadModule ssl_module modules/mod_ssl.so</p>
<p> </p>
<p>DocumentRoot "/var/www/html"</p>
<p> </p>
<p><VirtualHost *:80></p>
<p> </p>
<p></VirtualHost></p>
<p> </p>
<p><VirtualHost *:443></p>
<p> ErrorLog logs/ssl_error_log</p>
<p> TransferLog logs/ssl_access_log</p>
<p> #LogLevel warn</p>
<p> LogLevel debug</p>
<p> </p>
<p> SSLEngine on</p>
<p> SSLCertificateFile /var/tmp/HOME-test/HOME_<wbr>Server.pem</p>
<p> SSLCertificateKeyFile /var/tmp/HOME-test/HOME_<wbr>Server.key</p>
<p> SSLCACertificateFile /var/tmp/HOME-test/COMBO-test.<wbr>pem</p>
<p> #SSLCACertificateFile /var/tmp/HOME-test/HOME_Root_<wbr>CA.pem</p>
<p> </p>
<p> #SSLVerifyClient require</p>
<p> SSLVerifyClient optional</p>
<p> </p>
<p> #DocumentRoot "/var/www/html"</p>
<p></VirtualHost></p>
<p> </p>
<p>[/CODE]</p>
<p> </p>
<p>So when i try to browse to [url]<a href="https://host.local.com" target="_blank">https://host.local.com</a>[/<wbr>url] i get the error</p>
<p>"The owner of <a href="http://host.local.com" target="_blank">host.local.com</a> has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website"</p>
<p> </p>
<p>When i click on advanced i see</p>
<p>"<a href="http://host.local.com" target="_blank">host.local.com</a> uses and invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certficates. An addistional root certificate may need to be imported.</p>
<p> </p>
<p>Error code"SEC_ERROR_UNKNOWN_ISSUER"</p>
<p> </p>
<p>I created a Combo.pem file with the CA pem, Server pem, and client pem and put it as the SSLCACertificateFile but that didn't work either.</p>
<p> </p>
<p>What am i missing, I've been through so many web pages and still can't see the problem.<span></span></p><p><br></p><p>Also trying to set up a client/user pkcs12 cert/file to authenticate to the above listed webserver. I have access to a set of certs for a different system and in the client.pfx file there are 2 certificates, but mine only has one<span></span></p></span></div></div></div></div></div>
</div>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div>Richard W. Olsen</div><div>Sr Security Engineer<br><img style="font-size:12.8px" src="https://docs.google.com/uc?export=download&id=0B4k8Nrsck7keMzFiTzZhNWxreWc&revid=0B4k8Nrsck7keZzlFM0xtZE92ZWpoUnV1UlpMclBBRVNyT1NNPQ" width="96" height="12"><br></div><div>6310 Hillside Court, Suite 101<br>Columbia, MD 21046 USA<br>Phone: <a href="tel:301.225.9699" value="+14432832120" target="_blank">301-225-9699</a><br>Email: rolsen@Quotient-Inc.com</div></div></div></div></div>
</div>