# I am new to digital certificate 509V3 concept. can some one please clarify the below points [closed]

I am using RSA 2048 with SHA 256 primitive in certificate:

1. How to verify the user certificate n + 1 with Root certificate n?

2. why it is required to perform Certificate chain verification?

3. How to generate a sample certificate in openssl?

4. I have tried to generate the certificate in pem format,but i need the certificate in der format.

openssl req -x509 -newkey rsa:2048 -keyout keySample.pem -out sample.pem -days 365

so i have converted the format using below commands. openssl x509 -in sample.pem -outform der -out sample_cert.der

But when i try to parse the certificate with third party solution, unfortunately it returns not ok and the description of error says the parameter

We check whether the tag in the encoding can be ignored or, if not, whether the tag is the correct one for the subcomponent.

The tag cannot be ignored and it is not correct. The only chance we have is that the subcomponent is optional. Then we simply assume that the optional subcomponent does not exist.

where is the subcomponet and tag used in certificate? which field is this and resposible for which parameter?

1. can someone generate the file(DER format) with two above commands from openssl and let me know if you can able to parse successfully?

## closed as too broad by Maarten Bodewes♦, Squeamish Ossifrage, e-sushiJul 18 '18 at 5:47

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

• Five questions, three off topic, no time spend on formatting the question, multiple mispellings, wrong case, an error that has clearly not been copied directly, an unnamed 3rd party tool being used. Sheesh, can this question get any worse? And questions show clearly that none of the subject matter is currently understood. Root certificate n and user certificate n + 1??? – Maarten Bodewes Jul 16 '18 at 22:41
• @Maarten : Thanks for your comments. I would like to understand the concept and verification process. I'll find my answers, possibly if you can answer or correct the mistakes, its most welcome. – danny Jul 17 '18 at 6:58
• Possibly the 'third party' is referencing poorly the difference between critical and noncritical extensions. Check your (default) config file for the extensions set in the section referenced by x509_extensions if any, and/or look for any wrong or even unusual values in the extensions in your cert with openssl x509 -text -noout {-inform der -in derfile | -in pemfile} – dave_thompson_085 Jul 18 '18 at 8:18

1. How to verify the user certificate n+1 with Root certificate n?

Chain verification, where the trusted root certificate verifies the one underneath. The chain is build up from the user certificate upwards (the root certificate is on the top) because the user certificate contains information identifying the issuer.

1. Why it is required to perform Certificate chain verification?

You need to have a path to something you trust. A chain isn't required if you can directly trust the user certificate, e.g. through certificate pinning.

1. How to generate a sample certificate in openssl?

Off-topic here, and plenty of resources online.

1. I have tried to generate the certificate in pem format,but i need the certificate in der format.

Off-topic here, and plenty of resources online.

1. Can someone generate the file(DER format) with two above commands from openssl and let me know if you can able to parse successfully?

Sure, but not here, because that's off topic.