|
This is my first attempt to create a new child CA
after "upgrading" to the most recent beta version, and I appear to have some
issues trying to get the extensions to propogate to the new CA.
I did follow the instructions in the documentation,
waiting about 10min after configuring the new CA entity before activating it in
the Server Admin window. However, its profile is still showing up in the
root_ca window as having only the following fields: Version, Serial, Signature
Algorithm, Issue, Valid From, Valid Until, Subject, Public key, Thumbprint
Algorithm, and Thumbprint. My other child CA signed by the same root_ca
also has basicConstraints, nsComment, subjectKeyIdentifier,
authorityKeyIdentifier, nsCertType, and keyUsage.
I am able to retrieve the configuration I set on
the new child CA from the PKI Admin window, although curiously the configuration
of all the other CA's appears to be completely blank (although the entities
are still working as far as I can tell).
I can request and successfully sign new
certificates using the new child CA, but the certificates appear to be unusable
(Windows reports something like "the issuer of this certificate does not appear
to have the authority to issue certificates"). OpenVPN simply reports
"depth=1 VERIFY ERROR: invalid CA certificate".
I am continuing to issue certificates using the
original child CA (through the same RA) and they appear to be functioning
properly. Are there any hints on further diagnosing what may be going
wrong here? I am receiving a large number of error messages (mostly
"Invalid parameter", although I also occasionally get "duplicate keyid").
However, retrying the request a few times appears to get past these
errors.
|
