Comments on: Howto: Make Your Own Cert With OpenSSL http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/ (blog 'DidierStevens) Sat, 11 Feb 2012 16:16:49 +0000 hourly 1 http://wordpress.com/ By: Using DLLCHARACTERISTICS’ FORCE_INTEGRITY Flag « Didier Stevens http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-46846 Thu, 27 Oct 2011 17:46:47 +0000 http://blog.didierstevens.com/?p=1016#comment-46846 [...] the pieces to test this flag. A normal authenticode signature is not enough. And you can not use a selfsigned certificate. You need to buy a certificate (aka Software Publisher Certificate, SPC) from a commercial CA for [...]

]]> By: Howto: Make Your Own Cert With OpenSSL | Laurentiu Blog http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-45243 Tue, 16 Aug 2011 10:05:21 +0000 http://blog.didierstevens.com/?p=1016#comment-45243 [...] http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/ This entry was posted on marți, august 16th, 2011 at 14:57 and is filed under Linux. You can [...]

]]> By: MDT 2010 / Windows 7, driver ranking problem for Realtek HD Audio http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-42885 Wed, 18 May 2011 07:10:52 +0000 http://blog.didierstevens.com/?p=1016#comment-42885 [...] would be to sign the driver yourself… http://technet.microsoft.com/en-us/l…52(WS.10).aspx http://blog.didierstevens.com/2008/1…-with-openssl/ Reply With Quote [...]

]]> By: rain http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-42517 Fri, 22 Apr 2011 21:49:07 +0000 http://blog.didierstevens.com/?p=1016#comment-42517 Got this problem fixed but still got problem

It shows that new cert with old’s name and issuer. Any fix?

]]> By: rain http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-42516 Fri, 22 Apr 2011 21:30:43 +0000 http://blog.didierstevens.com/?p=1016#comment-42516 I created 1 cert wrong, so I deleted files but I cant create new cert.

OpenSSL> pkcs12 -export -out ia.p12 -inkey ia.key -in ia.crt -chain -CAfile ca.c
rt
Loading ‘screen’ into random state – done
Error self signed certificate getting chain.
error in pkcs12
OpenSSL>

]]> By: Quickpost: Adding Certificates to the Certificate Store « Didier Stevens http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-40416 Sun, 31 Oct 2010 13:31:23 +0000 http://blog.didierstevens.com/?p=1016#comment-40416 [...] you’ve a root certificate, like one created using this method. Here’s how to install it in your account’s “Trusted Root Certificate [...]

]]> By: jeng1111 http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-38287 Fri, 16 Apr 2010 19:54:36 +0000 http://blog.didierstevens.com/?p=1016#comment-38287 Thanks for your help! I installed my root cert on the other machines in the office by going to Start > Run… > mmc > File > Add/Remove snap-in > Add… and choosing Certificates. Then I right-clicked somewhere to import the root cert file I had made.

After I had installed the root CA, when I opened a file in Microsoft Office that I had signed (with a certificate that had been issued using that same root cert), I was presented with the option of always trusting files signed liked that.

Next I would like to experiment with creating a certificate just for code signing. I believe the information is here: http://www.openssl.org/docs/apps/x509v3_config.html under “Extended Key Usage.”

]]> By: Didier Stevens http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-37782 Fri, 05 Mar 2010 22:49:09 +0000 http://blog.didierstevens.com/?p=1016#comment-37782 @jeng1111 It’s the root CA you need to distribute (the self-signed one).

]]> By: jeng1111 http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-37780 Fri, 05 Mar 2010 21:17:08 +0000 http://blog.didierstevens.com/?p=1016#comment-37780 Thank you so much for sharing this!

In your instructions, I don’t know how you got around the requirement of designating an openssl.cnf configuration file. Maybe the version of OpenSSL you were using was compiled to look for it in the right place. Mine was compiled to look for it in /usr/local/ssl/openssl.cnf, which doesn’t exist on a Windows machine.

The next problem is, that on Windows XP at least, .cnf files are designated a NetMeeting “SpeedDial” files. But you can edit the file extension to break this link, or better yet have the extension open in Notepad. This isn’t absolutely necessary though.

I found the default openssl.cnf file installed in my OpenSSL/share directory, so I moved it to the bin directory, so when I ran openssl from there, I could just add -config openssl.cnf to my openssl commands when it complained about not finding it.

Finally, thank you again for your comment about the “Error self signed certificate getting chain” error. I went back and changed some of my answers to the cert issuing questions, and the error disappeared when I tried again.

My next task is to install a certificate (which one?) on my intranet Active Directory domain server, so all the computers in my domain will trust code that I sign with my digital signature.

]]> By: Didier Stevens http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/#comment-34864 Mon, 04 May 2009 20:07:19 +0000 http://blog.didierstevens.com/?p=1016#comment-34864 Update: the reason of “Error self signed certificate getting chain.” is that you use identical data for your CA and IA certificate.

]]>