Signing a certificate with my CA

Question

On running:

openssl ca -in ${ALIAS}.csr -out user-cert.pem -keyfile cacert-private.pem -cert cacert.pem -passin pass:$PASSWD -config ${CONFIG}

Answer 1

You can also set the attributes as optional:

# For the CA policy

[policy_match]
countryName= optional
stateOrProvinceName= optional
organizationName= optional
organizationalUnitName= optional
commonName= supplied
emailAddress= optional

Answer 2

I have also run into this problem. Thanks to the replies above (mainly Francois), I discovered the source of the problem.

openssl is encoding using UTF8STRING and keytool (Java 6) is encoding with PRINTABLESTRING.

Worked around it by changing the openssl configuration so it matches keytool. In /usr/ssl/openssl.cnf change the "string_mask" setting to "pkix".

Answer 3

I just ran into this problem. The root cause is a mismatch between the values of string_mask in the client's and the CA's openssl.cnf. The easy fix is to modify the client's value to match what the CA expects, then regenerate the CSR. The hard fix is to edit the CA's value and start a fresh CA.

Answer 4

As shown by :

openssl asn1parse -in req.csr  

the request DN strings are encoded as PRINTABLESTRING.

openssl asn1parse -in cacert.pem 

shows the CA DN strings are encoded as UTF8STRING.

For a quick'n dirty hack, I suggest you change the encoding of strings in your request by replacing the encoding type for PRINTABLESTRING (0x13) by the type for UTF8STRING (0x0c), using your favorite hex editor.
You will have to convert your request in DER before poking it.
The offset of bytes to change can be found with :

openssl asn1parse -in csr |grep PRINTABLESTRING |awk -F":" '{print $1}' 

Then try to sign again.

Answer 5

The previous posters already answered the question, but to make it easier, here is an example how to specify the encoding. Use the string_mask:

[ req ]
default_bits            = 2048
default_md              = rsa
prompt                  = no
string_mask             = utf8only  # <--------------
distinguished_name      = req_distinguished_name

[ req_distinguished_name ]
countryName             = GB
stateOrProvinceName     = Gloucestershire
localityName            = Cheltenham
organizationName        = Wansdyke House Limited
organizationalUnitName  = Fizio
commonName              = localhost

Answer 6

^{Promoting mbrownnyc's comment to an answer, as it was useful to me and deserves more attention.}

I believe /usr/ssl/openssl.cnf contains a policy called policy_anything that contains the above setup. You can use it by utilizing the policy argument as follows:

openssl ca -policy policy_anything -days 365 -out /root/ca/certs/out.pem -in certreq.csr