Unable to write 'random state' error while creating a p12 file using openssl

Error: Unable to write 'random state'

Solution:

I have seen this error while generating a p12 file by providing the key and certificate as input.

This error popped up due to insufficient privileges. To avoid this error, Run the commands after opening the command prompt with admin privilege.

Read More

How to Install Openssl and configure/generate SSL certificate on windows

Download and Install OpenSSL:

The software can be downloaded from a source like Shining Light (https://slproweb.com/products/Win32OpenSSL.html).

-> The installation is pretty straight forward, Just remember the path of the installation as this path will be used while creating the key and csr.

For ex: I have installed the OpenSSL in C:\OpenSSL-win

-> Create a folder in any directory ( like C:\Openssl)

-> Run the command prompt with admin privileges and execute the following given command.

       set OPENSSL_CONF=c:\OpenSSL-win\bin\openssl.cfg

This will set a variable in windows configuration.

-> Generate the Key and Certificate request (CSR) by executing the below command.
     This command has to be run from the Openssl bin folder (C:\OpenSSL-win\bin)

       openssl req -nodes -sha256 -newkey rsa:2048 -keyout C:\Openssl\keyfile.key -out C:\Openssl\Certificaterequest.csr

-> You will be prompted for certificate fields like fqdn,location and state, enter those fields as they come up.

     This will generate two files
       a) keyfile.key
       b) Certificaterequest.csr -> This has to be sent to the valid signer to get the certificate.
      

Read More

Unable to load config info from /usr/local/ssl/openssl.cnf

Issue: While trying to generate the csr from the key using openssl in windows, The following error will be displayed.

 

Solution: download the openssl.cnf file from the following link and paste the file any location. I prefer to keep the files in config folder of openssl folder structure.

You will get this error while trying to generate the csr. Incase if you do not know the steps to generate key,cse and crt. Please go through the following link.

Configuring ssl with apache

The commands from the above link would be similar for windows as you are using openssl.

After placing the openssl.cnf file, use the following command to generate the csr. 

openssl req -new -key server.key -out server.csr -config < path of openssl.cnf>

This command will ask you for the common name,organization unit name etc. After providing all the details a csr will be generated. A vendor signed or self signed certificate can be requested.

                                 (: Happy learning :)

Read More

Configuration of ssl with apache (Red hat linux) using openssl

Steps to install and configure the self signed SSL certificate with Apache on Red Hat Linux

Installation of Openssl:  

 

Step 1: Download the openssl software from (http://www.openssl.org/)

Step 2:tar -xzf openssl-1.0.1f.tar.gz

Step 3: cd openssl-1.0.1f

Step 4: ./config --prefix=/usr/openssl -fPIC no-gost no-shared no-zlib

Step 5: make

Step 6: make install

The above steps will install the openssl software in /usr/openssl. You can define the openssl path in the PATH variable.

Apache installation:

 

  ./configure --prefix=/usr/local/apache2/ --enable-mods-shared=all --enable-ssl=shared --enable-proxy=shared --enable-proxy-connect=shared --enable-proxy-ajp=shared --enable-proxy-balancer=shared --enable-proxy-ftp=shared --enable-proxy-http=shared --enable-so --with-ssl=/usr/openssl/ 

Steps to generate key,csr and crt:

/usr/openssl/bin/openssl genrsa -out commonname.key 2048 -- Generate a 2048 bit key

/usr/openssl/bin/openssl req -new -key commonname.key -out commonname.csr -- To generate a CSR

/usr/openssl/bin/openssl x509 -req -days 365 -in commonname.csr -signkey commonname.key -out commonname.crt  - To generate the selfsigned certificate

Add the ssl configuration in apache httpd.conf file:

LoadModule ssl_module modules/mod_ssl.so

<VirtualHost servername:443>
    ServerName hostname
    SSLEngine On
    SSLCertificateFile /usr/commonname.crt
    SSLCertificateKeyFile /usr/commonname.key
    SSLProxyEngine On

</VirtualHost>

Start and stop the server using -DSSL option:

apache/bin/httpd -k start -DSSL

apache/bin/httpd -k stop -DSSL

                                           

                                                          (: Happy learning :)

Read More