Ssl – Generating a client-side SSL/TLS certificate from in the browser

Create Root CA (self-signed):

Let's have a look at the options in detail:

• x509 identifies that a certificate is required, rather than just a certificate request (see below).
• days 30000 sets the certificate to expire in a 30000 days. You may want to extend this period. Make a note of the expiry date so that you can renew it when necessary!
• sha1 specifies that SHA1 encryption should be used. rsa:2048 sets the key as 2048 bit RSA.
• nodes specifies no passphrase.
• keyout and -out specify where to store the certificate and key. The key should be root-readable only; the certificate can be world-readable, and must be readable by the user that Apache runs as.
• subj flag sets the company name, department name, and the web site address. If you leave these out, you'll be prompted for them. The CN must be the same as the address of your web site, otherwise the certificate won't match and users will receive a warning when connecting. Make sure you don't use a challenge password.

Create it :

sudo openssl req -x509 -nodes -newkey rsa:2048 -sha1 -keyout rootkey.key -out rootca.crt -passin pass:root -days 30000 -subj "/C=DU/ST=Dubai/L=TownCenter/O=AmesCom/CN=AmesCom Int" -config openssl.cnf.my

Encrypt the key manually :

key is not encrypted because of -nodes option , so we encrypt it manually :

sudo cp rootkey.key rootkey.key.org

sudo openssl rsa -in rootkey.key.org -out rootkey.key

Test it :

for testing immediately , you may follow two ways :

openssl x509 -text -noout -in rootca.crt 

or examine its contents on browser :

cp rootca.crt /var/www/html/

from browser ask for address :

http://yourserverdomain/rootca.crt

Now you can create certificate requests and sign them with this self-signed certificate

SSL X509 certificate file is a file containing a certificate in the format specified by the ITU in their X series of specifications - specifically x.509. There is no private-key information there as it is a certificate format so things like names, public keys, signatures, validity dates and other goodies go in there - but not private-keys.

PEM is a set of specifications for Privacy Enhanced Mail - it offers for the most part packaging standards that are build off of the PKCS specs (PKCS specs were developed by RSA and RSA labs themselves for public use to enable interoperability between various implementations - this was done again by the IETF and by the community in other arenas). You can use openssl to convert formats around - see here http://www.openssl.org/docs/apps/openssl.html . Concatenation won't help you any.

If the certificate is self-signed then it's kind of odd that a CA gave it to you - that makes me think that you are telling about feeding the Gandi CA certificate to openssl which is telling you that cert is self signed (ergo it is a root or end entity certificate but certainly not an intermediate aka chain certificate).

To address some of your points: 1 Self signed certs will always generate warnings in good clients because they lack trust until the user decides they are trustworthy (or for most users.. until Microsoft , Mozilla Foundation, Google, or Opera) decides the user should trust that CA). If your clients (browsers or whatever) have the CA stored and marked as trusted then this warning won't pop-up. 2 Possibly 3 Looks like you used the right key and CSR with Gandi 4 Looks to me like you need to load the domain key and cert and possibly CA into OpenSSL either via OS level trust configuration or via Stud configuration.