I've set up a small PKI using the
openssl ca, by following a guide which explains the procedure and some of the concepts in good detail. I want to accomplish pretty much that three-tiered setup that is outlined in that article, namely that the actual certificates are issued by an Intermediate CA which is in turn 'governed' by a Root CA, with the Root CA being self-signed and eventually deployed to the clients concerned. I have tried to reproduce the configuration in the article as close as possible, to prevent that I customise too many things at once which I don't understand yet.
So far, I have the following:
- The certificate and 'infrastructure' for the root CA.
- The certificate and 'infrastructure' for the intermediate CA.
- The CRLs for both CAs.
- A test certificate, issued by the intermediate CA, to check whether all of this works.
- Copies of the Demo CA for comparison.
In theory, by deploying the root CA's certificate to a browser and then browing to the website secured by that last certificate, I should get 'the padlock icon'. This does work with Internet Explorer, Chrome and Firefox. Opera is acting up and bails with 'Secure connection: fatal error (1578)', so something is obviously broken.
A forum article suggests that the problem lies in the CRLs, so I went to investigate there. Internet Explorer has no problems in opening the CRLs and displays them correctly, without any notice that there is something wrong. Firefox on the other hand refuses and gives 'Error code ffffe00a', which indicates problems with the signature (
Error -8182: SEC_ERROR_BAD_SIGNATURE: Peer's certificate has an invalid signature.). This however only happens only when I did import the CA certificate first. If I don't, then the CRL is accepted without problems.
I have verified all the certificates and CRLs with whichever invocations of both
openssl and Microsoft's
certutil.exe that I could get my hand on, all of which giving me the thumbs up.
Putting my certificates side to side next to the demo certificates in the abovementioned article I don't see difference—other than the names, of course. So in theory they should behave the same. But trying to import the root certificate of the Demo CA and then looking at the CRL works, in all browsers, whereas my own Root CA leads to those weird errors. (Lacking the private keys of the Demo CA, I can of course not test whether certificates issued by the Demo CA would work.)
I am stymied. I seem to be missing something subtle, but important, but I am out of ideas and resources. Thank you for any suggestions or pointers.