I have created my own CA:
openssl genrsa -out private/rootCA.key 2048 openssl req -batch -new -x509 -nodes -key private/rootCA.key -sha256 -days 1024 -config ./openssl.conf -out certs/rootCA.pem
I have created a certificate for my site:
openssl genrsa -out private/$domain.key 2048 openssl req -batch -new -key private/$domain.key -config ./openssl.conf -subj "/commonName=$domain" -out csr/$domain.csr openssl x509 -req -in csr/$domain.csr -CA certs/rootCA.pem -CAkey private/rootCA.key -CAcreateserial -out certs/$domain.crt -days 500 -sha256
I join the site cert and the root cert into a bundle:
cat certs/$domain.crt certs/rootCA.pem > bundles/$domain.bundle.crt
I copy the cert / key to the nginx config dir:
cp bundles/$domain.bundle.crt private/$domain.key /etc/nginx/conf/certs
I make sure that nginx uses those certs for my site:
ssl_certificate /etc/nginx/certs/mysite.bundle.crt; ssl_certificate_key /etc/nginx/certs/mysite.key;
I restart nginx.
I install the root cert in my system:
sudo cp certs/rootCA.pem /usr/local/share/ca-certificates/myrootCA.crt sudo update-ca-certificates
I verify with
» http https://mysite
http: error: SSLError: HTTPSConnectionPool(host='mysite', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",),))
I verify with
openssl (telling it to use the ca-certificates dir, which is not used by default it seems):
openssl s_client -host mysite -port 443 -prexit -showcerts -CApath /usr/local/share/ca-certificates
Verify return code: 19 (self signed certificate in certificate chain)
And verification does not complete.
Opening the site in Chrome gives me the standard error:
This server could not prove that it is mysite; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.
I have two questions:
- Why is the site not trusted, system-wide, after installing the root cert? Chrome is using system-wide cerficates, right?
- Why is
open_ssl s_clientnot able to complete the cert validation?
Curl is working, with the system-wide installed cert:
Why is curl working and chrome/httpie not?