Hi, I have just installed openssl-0.9.4, and am trying to get a certificate request signed by thawte. When I cut and paste the CSR into their test server interface (https://www.thawte.com/cgi/server/test.exe), I get back the error; "Your CSR is not self-signed." Does anyone know why I am getting this error, and what can be done to correct it? (CSR's generated with other software work fine.) I feel like I am missing something obvious, but I do not see it. I used the following to generate the key and CSR; openssl req -new -newkey 1024 -keyout mail.swales.com-key -outform PEM -out mail.swales.com-csr When I look at the output of the the CSR I get the following; openssl req -noout -text -in mail.swales.com-csr Certificate Request: Data: Version: 0 (0x0) Subject: C=US, ST=Maryland, L=Beltsville, O=Swales and Associates, Inc., OU=Information Systems, [EMAIL PROTECTED] Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:e3:d1:4a:b2:9c:5c:e2:0a:da:b2:77:41:ee:c6: e8:c4:d1:c8:ef:bd:05:60:c5:02:37:44:24:72:dc: 76:e3:7d:15:e2:f3:a5:e2:a5:08:6e:4a:2f:b2:a3: 51:a6:64:7a:35:d0:13:c4:23:6d:f4:4c:ec:87:16: 41:b4:15:83:fc:c8:54:38:75:b8:b7:10:4a:a3:3e: f6:3d:49:69:9e:c0:69:c7:37:df:ec:6b:c3:f2:24: 65:3d:d7:89:ac:87:24:37:8e:0d:8a:f3:b7:b3:bd: 37:33:32:4f:07:fb:fb:60:3c:e5:01:7b:92:a2:a9: 27:e7:25:54:92:9d:f9:4d:91 Exponent: 65537 (0x10001) Attributes: a0:00 Signature Algorithm: md5WithRSAEncryption bd:aa:95:a5:47:e0:f4:7c:69:16:79:ce:e1:fb:3b:34:b3:28: ac:97:47:d1:2e:22:8c:11:c8:4d:e9:e7:64:bd:9d:42:9e:72: e8:d2:84:66:e9:ab:da:ca:fc:46:a5:93:b8:09:f4:4c:6e:12: 7c:9c:ec:52:dd:71:d2:0c:51:41:cc:8c:48:43:1f:9d:ec:b8: cf:e7:7b:b2:e4:cd:21:c3:3d:5f:83:db:76:b0:65:6b:58:dd: 17:04:bc:7a:47:b0:80:0c:c0:01:93:56:3b:f5:1b:72:21:c7: f6:94:b9:59:a8:3c:af:b8:fb:06:72:61:2d:72:36:3a:a4:d4: 00:83 Are there any special fields in the openssl.cnf file that might be wrong? The working lines of my openssl.cnf file follow; RANDFILE = $ENV::HOME/.rnd oid_file = $ENV::HOME/.oid oid_section = new_oids [ new_oids ] [ ca ] default_ca = CA_default # The default ca section [ CA_default ] dir = /usr/local/ssl # Where everything is kept certs = $dir/certs # Where the issued certs are kept crl_dir = $dir/crl # Where the issued crl are kept database = $dir/index.txt # database index file. new_certs_dir = $dir/newcerts # default place for new certs. certificate = $dir/cacert.pem # The CA certificate serial = $dir/serial # The current serial number crl = $dir/crl.pem # The current CRL private_key = $dir/private/cakey.pem# The private key RANDFILE = $dir/private/.rand # private random number file x509_extensions = usr_cert # The extentions to add to the cert default_days = 365 # how long to certify for default_crl_days= 364 # how long before next CRL default_md = md5 # which md to use. preserve = no # keep passed DN ordering policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match localityName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] default_bits = 1024 default_keyfile = privkey.pem distinguished_name = req_distinguished_name attributes = req_attributes x509_extensions = v3_ca # The extentions to add to the self signed cert [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = US countryName_min = 2 countryName_max = 2 stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Maryland localityName = Locality Name (eg, city) localityName_default = Beltsville 0.organizationName = Organization Name (eg, company) 0.organizationName_default = Swales and Associates, Inc. organizationalUnitName = Organizational Unit Name (eg, section) organizationalUnitName_default = Information Systems commonName = Common Name (eg, YOUR-or-FQDN name) commonName_max = 64 emailAddress = Email Address emailAddress_default = [EMAIL PROTECTED] emailAddress_max = 40 [ req_attributes ] challengePassword = A challenge password challengePassword_min = 4 challengePassword_max = 20 CN = Just hit ENTER (or a dummy string) unstructuredName = An optional company name [ usr_cert ] basicConstraints=CA:FALSE nsCertType = server nsComment = "Swales Aerospace Generated Certificate" subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer:always [ v3_ca ] subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer:always basicConstraints = CA:true [ crl_ext ] authorityKeyIdentifier=keyid:always,issuer:always Thank you for your suggestions. Randall ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
