Certificate creation????

[Andrew Street]

Hi Andreas,

Had the same problem recently - it's due to the -next_serial option 
being unsupported in your version of OpenSSL but the CA.pl script 
requiring it! The -next_serial option was introduced in OpenSSL version 
0.9.7e :

Changes between 0.9.7d and 0.9.7e  [XX xxx XXXX]
   
  -  *)
  +  *) Reduce the chances of duplicate issuer name and serial numbers (in
  +     violation of RFC3280) using the OpenSSL certificate creation utilities. 
  +     This is done by creating a random 64 bit value for the initial serial
  +     number when a serial number file is created or when a self signed
  +     certificate is created using 'openssl req -x509'. The initial serial
  +     number file is created using 'openssl x509 -next_serial' in CA.pl
  +     rather than being initialized to 1.
  +     [Steve Henson]


I'm had installed 0.9.7g without removing an existing version of openssl 
(0.9.7d). I don't know if this is your problem but I would try removing 
all versions of openSSL and reinstalling 0.9.7g - everything should work 
when the CA.pl script and the openssl versions are 'in-line'

Hope this helps

Andy Street


Andreas Korber wrote:

>Hi,
>What i am doing wrong? The creation of my certificates for EAP/TLS with
>CA.all or CA.certs always end with an message like this:
>
>-----
>Country Name (2 letter code) [AU]:State or Province Name (full name)
>[Some-State]:Locality Name (eg, city) []:Organization Name (eg, company)
>[Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common
>Name (eg, YOUR name) []:Email Address []:
>Please enter the following 'extra' attributes
>to be sent with your certificate request
>A challenge password []:An optional company name []:Using configuration from
>/etc/ssl/openssl.cnf
>./demoCA/serial: No such file or directory
>error while loading serial number
>3164:error:02001002:system library:fopen:No such file or
>directory:bss_file.c:276:fopen('./demoCA/serial','r')
>3164:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:278:
>Failed to do sign certificate
>radius:/usr/local/etc/raddb/certs #
>
>
>So i looked for the serial file. But it dosn´t exist. I think because of an
>earlier message:
>
>CA certificate filename (or enter to create)
>unknown option -next_serial
>usage: x509 args
> -inform arg     - input format - default PEM (one of DER, NET or PEM)
> -outform arg    - output format - default PEM (one of DER, NET or PEM)
> -keyform arg    - private key format - default PEM
> -CAform arg     - CA format - default PEM
> -CAkeyform arg  - CA key format - default PEM
> -in arg         - input file - default stdin
> -out arg        - output file - default stdout
> -passin arg     - private key password source
> -serial         - print serial number value
> -hash           - print hash value
> -subject        - print subject DN
> -issuer         - print issuer DN
> -email          - print email address(es)
> -startdate      - notBefore field
> -enddate        - notAfter field
> -purpose        - print out certificate purposes
> -dates          - both Before and After dates
> -modulus        - print the RSA key modulus
> -pubkey         - output the public key
> -fingerprint    - print the certificate fingerprint
> -alias          - output certificate alias
> -noout          - no certificate output
> -ocspid         - print OCSP hash values for the subject name and public
>key
> -trustout       - output a "trusted" certificate
> -clrtrust       - clear all trusted purposes
> -clrreject      - clear all rejected purposes
> -addtrust arg   - trust certificate for a given purpose
> -addreject arg  - reject certificate for a given purpose
> -setalias arg   - set certificate alias
> -days arg       - How long till expiry of a signed certificate - def 30
>days
> -checkend arg   - check whether the cert expires in the next arg seconds
>                   exit 1 if so, 0 if not
> -signkey arg    - self sign cert with arg
> -x509toreq      - output a certification request object
> -req            - input is a certificate request, sign and output.
> -CA arg         - set the CA certificate, must be PEM format.
> -CAkey arg      - set the CA key, must be PEM format
>                   missing, it is assumed to be in the CA file.
> -CAcreateserial - create serial number file if it does not exist
> -CAserial arg   - serial file
> -set_serial     - serial number to use
> -text           - print the certificate in text form
> -C              - print out C code forms
> -md2/-md5/-sha1/-mdc2 - digest to use
> -extfile        - configuration file with X509V3 extensions to add
> -extensions     - section from config file with X509V3 extensions to add
> -clrext         - delete extensions before signing and input certificate
> -nameopt arg    - various certificate name options
> -engine e       - use engine e, possibly a hardware device.
> -certopt arg    - various certificate text options
>
>
>
>
>
>Can anyone help me plaese??
>
>
>
>- 
>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
>  
>