I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of document, there is some information for adding CA certificate to Browser. Before that I should create PKCS#12 certificate using follwoing commands:

openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mycert.pem -out      mycert.pem
openssl pkcs12 -export -out mycert.pfx -in mycert.pem -name "Certificate for Whatever"

to create pfx file. But the problems is how this could relates to CA certification? For example, in the document the author generated a file called cacert.pem for CA certification and a file called cakey.pem for server private key. What is usage of the filemycert.pem?

As another note, after I runs following command:

openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mycert.pem -out      mycert.pem

I asked for entering Common Name information (like city, organization, ...). I entered some information (randomly) to the questions and finally after executing second command I produced mycert.pfx file and imported it to Firefox (as described in the end of document). But it does not recognized the .pfx file and nothing has been imported!

After that I decide to import cacert.pem and the file successfully added to list of trusted authorities:

enter image description here

But after importing certificate to Firefox and restarting it, When I request the page, I got This Connection is Untrusted page (meaning Firefox does not trust in my CA certificate) in the response. Where is the problem?

Updates: I added following image from my Firefox exception certificate view:

enter image description here

  • 2
    Does the Common Name matches the name you type in the browser? I see you are on "localhost" did you issued a certificate for "localhost" as well? – M'vy Feb 27 '15 at 14:37
  • @M'vy can I add mousaviserver.com (Common name for apache sever certificate) to my hosts file in Windows and try it again? – Seyed Morteza Mousavi Feb 27 '15 at 14:45
  • Just to clarify, you've also imported the certificate on the Windows machine? – RoraΖ Feb 27 '15 at 15:05
  • @raz before I check it, can you suggest me which one I should add to my windows (and browser)? mycert.pfx or cacert.pem? – Seyed Morteza Mousavi Feb 27 '15 at 15:08
  • I don't see where you generated cacert.pem. I would go with mycert.pem. .pem or .pfx is just the format of the certificate. Firefox only supports a few and .pfx isn't one of them. – RoraΖ Feb 27 '15 at 15:22

openssl req -x509 [...]
to create pfx file. But the problems is how this could relates to CA certification?

Not at all. The "-x509" parameter triggers generation of a SELF SIGNED certificate. I.E. it is not signed by your CA.

See https://www.openssl.org/docs/apps/req.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.