The more randomness you put into the random number generator, the better keys you will get. I've been know to use something as simple as
(df; date) >RANDFILE
the theory being that it is hard to predict the exact amount of free file space on (random date in the past) and that the output of date is always changing, but clearly one could do better. You might also investigate the possibility of patches to your operating system to implement /dev/random which uses things like Ethernet packet arrival times to generate random numbers. I know there is a patch for Solaris, we are using it. Linux has it built in.
Ronan wrote:
I'd suggest you use the CA.pl script instead. That should make things much
easier.
i have a csr (in pem format(by default)) and a key
I want to sign the csr with my domains root CA
I want then to change it to pkcs12 format
Finally i want to install it onto an Active Directory (win 2000 advanced) machine so i can ssl to the AD
using the CA.pl and my current key and csr
copy mycsr.csr to newreq.pem and run
# /home/local/ssl/misc/CA.pl -sign Signed certificate is in newcert.pem
.... its not there is no newcert.pem
is this what im after?
/usr/local/ssl/bin/openssl x509 -req -in ./CSR.csr -CA ./cacert.pem -CAkey ./private/cakey.pem -CAserial ./serial -out ./signedcert.pem
well it does output signedcert.pem but it gives me this message
unable to load 'random state' This means that the random number generator has not been seeded with much random data. Consider setting the RANDFILE environment variable to point at a file that 'random' data can be kept in (the file will be overwritten). Signature ok
im in csh atm
Is this a problem...??
help!
Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
-- Charles B (Ben) Cranston mailto: [EMAIL PROTECTED] http://www.wam.umd.edu/~zben
______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
