9:12 p.m.
Hi,
I'm trying to create a certificate to install in my apache server or
Internet Information Service, I follow the steps in this direction URL:
http://pki.fedoraproject.org/wiki/Apache_Cert_Enrollment
Some simple steps are listed here on how to proceed to enroll a server
certificate for an apache webserver with Dogtag.
STEP ONE: Generate a Key/CSR:
openssl genrsa -des3 -out www.mydomain.com.key 1024
openssl req -new -key www.mydomain.com.key -out www.mydomain.com.csr
Fill out all the prompts here including
CountryName,State,Locality,Organization Name, Organizational Unit Name,
Common Name.
Sample CSR from the above commands:
-----BEGIN CERTIFICATE REQUEST-----
MIIBqDCCARECAQAwaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEx
FTATBgNVBAcTDE1vdW50YWluVmlldzEPMA0GA1UEChMGUmVkSGF0MQwwCgYDVQQL
EwNJRE0xDjAMBgNVBAMTBWEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
gQDMbwtFUZNzlfWRI19nuxKsbhJ1/5A/rrXQkH7+K1uqxmzytm6b57lkGK9YUC7B
qSKpJ4zzOnVqwRZsE9oJ5CSv+eQUie1NTz4KEL9ZOsN4p2zn0JFaKqze/vxZ3Rux
BKnAz34KxOKZxGTiychOTytWS6V4lDzKBvgTgf0EZfOcfwIDAQABoAAwDQYJKoZI
hvcNAQEEBQADgYEAxRGViyX5MxedhfSOja3XmvCcTOZL+btT7u4zztGBz71qSGhz
yLcFCHCOMngsfiHxySBUIjZdGAOjrwcwT04ig/C2TE8mTamDp7d8/zQ6k9De/9Dp
Q+C7PZuTYQkDf417IxbalEWhhNQ2AE6pMxfWwWAhjP1jAFLdKQZtEVNG9AQ=
-----END CERTIFICATE REQUEST-----
STEP TWO: Submit this CSR to the "Server Certificate Enrollment" profile of
the Dogtag CA and get it approved.
STEP THREE: Download the Cert and the CA and get them installed in apache.
I have problems in step three, when I click on the option "Import Your
Certificate" from the web console Dogtag Certificate Manager, I receive the
following message:
"This certificate cannot staff be installed Because you do not own the
Corresponding private key"
Searching in google I found this:
When I try to download my issued certificate, I get an “Accept in PKCS7”
error message.
If you are getting the “Error in accept PKCS7″ message that means that the
Microsoft OS/Internet Explorer cannot find the private key(s) for those
certificates. (Please note that this does not necessarily mean that the
private key(s) are not there, just that the MS system cannot find them.)
This happens because:
- the request was done under a different log-in profile (you are
logged on under a different username/password) than when the request was
made
- or the request was made with a different browser (for example,
Firefox)
- or the request was made on a different computer than the one you
are trying to import it on
- or something was done to the machine (like an update to the
operating system - a Windows update, profile change, computer re-imaged,
etc.)
You will only be able to import the issued certificate onto the same
computer, same log-in profile, and using the same web browser as when you
made the on-line request. (i.e. as when you got the “Print this form” web
page).
Well now!, I have the certificate in Base 64 format, Dogtag console shows me
the following information:
Installing this certificate in a server
The Following format can be used to install this certificate into a server.
Base 64 encoded certificate
In this picture I deleted some lines deliberately, but my certificate is
complete.
Base 64 encoded certificate with CA certificate chain in pkcs7 format
In this picture I deleted some lines deliberately, but my certificate is
complete.
Well now!, what I do with this information?, How I generated my certificate
with this plane format? Since in my web browser from the console does not
allow me to import the certificate.
How I can generate my certificate from the command line?
How I can generate my certificates in .cer, .crt, .pfx, .p12?
What format should I use?
