0
$\begingroup$

I was using the following command to build a self-signed certificate after creating a private key:

openssl x509 -in "server.csr" -out "server.crt" -req -signkey "myprivate.key" -days 365

After some ensuing troubles, and lots of googling I cobbled together a script, which culminated in:

openssl req -config ${CONFIGFILE} -new -x509 -sha256 -newkey rsa:2048 -nodes -keyout "server.key" -days 365 -out "server.crt"

How does this work, given I'm no longer passing it my "myprivate.key" to actually self-sign the cert?

Is "server.key" now being used to do the signing, and do I need to somehow combine this new key with the original "myprivate.key" to create a keychain? I ask since commandline tools don't seem to like the resulting certificate (e.g. curl says: 'SSL certificate problem: unable to get local issuer certificate').

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

Your second command generates a new RSA key and writes it in server.key, along with the self-signed certificate in server.crt.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Hi @conrado, I'm going to accept your answer since server.key is indeed a net new key. With regard to the part of my question about 'Do i need to somehow combine....' ... I learned later that what I needed was a separate self-signed key, acting as a CA, to sign this server request. Hope it helps someone else. $\endgroup$
    – yen
    Commented Feb 28, 2018 at 1:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.