Re: [Pki-users] How to generate cert from command line...

Hi, I'm trying to create a certificate to install in my apache server or Internet Information Service, I follow the steps in this direction URL: http://pki.fedoraproject.org/wiki/Apache_Cert_Enrollment Some simple steps are listed here on how to proceed to enroll a server certificate for an apache webserver with Dogtag. *STEP ONE:*Generate a Key/CSR: openssl genrsa -des3 -out www.mydomain.com.key 1024 openssl req -new -key www.mydomain.com.key -out www.mydomain.com.csr Fill out all the prompts here including CountryName,State,Locality,Organization Name, Organizational Unit Name, Common Name. Sample CSR from the above commands: -----BEGIN CERTIFICATE REQUEST----- MIIBqDCCARECAQAwaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEx FTATBgNVBAcTDE1vdW50YWluVmlldzEPMA0GA1UEChMGUmVkSGF0MQwwCgYDVQQL EwNJRE0xDjAMBgNVBAMTBWEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB gQDMbwtFUZNzlfWRI19nuxKsbhJ1/5A/rrXQkH7+K1uqxmzytm6b57lkGK9YUC7B qSKpJ4zzOnVqwRZsE9oJ5CSv+eQUie1NTz4KEL9ZOsN4p2zn0JFaKqze/vxZ3Rux BKnAz34KxOKZxGTiychOTytWS6V4lDzKBvgTgf0EZfOcfwIDAQABoAAwDQYJKoZI hvcNAQEEBQADgYEAxRGViyX5MxedhfSOja3XmvCcTOZL+btT7u4zztGBz71qSGhz yLcFCHCOMngsfiHxySBUIjZdGAOjrwcwT04ig/C2TE8mTamDp7d8/zQ6k9De/9Dp Q+C7PZuTYQkDf417IxbalEWhhNQ2AE6pMxfWwWAhjP1jAFLdKQZtEVNG9AQ= -----END CERTIFICATE REQUEST----- *STEP TWO:*Submit this CSR to the "Server Certificate Enrollment" profile of the Dogtag CA and get it approved. *STEP THREE:*Download the Cert and the CA and get them installed in apache. I have problems in *step three*, when I click on the option "Import Your Certificate" from the web console Dogtag Certificate Manager, I receive the following message: "This certificate cannot staff be installed Because you do not own the Corresponding private key" Searching in google I found this: When I try to download my issued certificate, I get an “Accept in PKCS7” error message. If you are getting the “Error in accept PKCS7″ message that means that the Microsoft OS/Internet Explorer cannot find the private key(s) for those certificates. (Please note that this does not necessarily mean that the private key(s) are not there, just that the MS system cannot find them.) This happens because: -the request was done under a different log-in profile (you are logged on under a different username/password) than when the request was made -or the request was made with a different browser (for example, Firefox) -or the request was made on a different computer than the one you are trying to import it on -or something was done to the machine (like an update to the operating system -- a Windows update, profile change, computer re-imaged, etc.) You will only be able to import the issued certificate onto the same computer, same log-in profile, and using the same web browser as when you made the on-line request. (i.e. as when you got the “Print this form” web page). Well now!, I have the certificate in Base 64 format, Dogtag console shows me the following information: Installing this certificate in a server The Following format can be used to install this certificate into a server. Base 64 encoded certificate In this picture I deleted some lines deliberately, but my certificate is complete. Base 64 encoded certificate with CA certificate chain in pkcs7 format In this picture I deleted some lines deliberately, but my certificate is complete. Well now!, what I do with this information?, How I generated my certificate with this plane format? Since in my web browser from the console does not allow me to import the certificate. How I can generate my certificate from the command line? How I can generate my certificates in .cer, .crt, .pfx, .p12? What format should I use?