OpenSSL Error on Windows 10 – Convert Signed CSR from PEM to CRT

certificatecsropensslwindowsx509

I am attempting to create an IPSec VPN connection with x.509 cert authentication for users.

What follows is a test to get things going and isn't a secure implementation. I will get a certificate from a trusted source when I get this working, in the meantime I'm using a self-signed.

I'm on Windows 10 20H2

1- I create a root certificate with XCA.

2- I create a certificate signing request for, say, my first vpn user.

3- I sign the request with XCA

4- I export the request from XCA in PEM format

5- I install OpenSSL and set env variable OPENSSL_CONF to the openssl.cfg in the install folder. I used https://slproweb.com/products/Win32OpenSSL.html (64bit) for openSSL on W10

6- The fun begins.

To my understanding, I have to add the certificate in the windows machine through mmc in command line using the snap-in cert. addition wizard thingy. It doesn't accept pem format, it wants a crt.

I then refer to OpenSSL for conversion of the formats

When I type in x509 -in CERT.pem -out CERTII.crt

I get the following error:

Can't open CERT.pem for reading, No such file or directory
15732:error:02001002:system library:fopen:No such file or directory:crypto\bio\bss_file.c:69:fopen('CERT.pem','r')
15732:error:2006D080:BIO routines:BIO_new_file:no such file:crypto\bio\bss_file.c:76:
unable to load certificate
error in x509

I've searched quite a bit and can't find an exact meaning to this error and I'm contemplating pulling my hair out one by one as a viable alternative.

EDIT 2020-12-11 1600

renaming to .crt and adding to local certificates gave me an error:

file type is not recognizable. Select another file.

Also, even when specifying the full path in the openssl cli with admin priv., I get an error.

If, for example, I copy the cert into the OpenSSL folder, and attempt the command "openssl x509 -in CERT.pem -out CERT.crt", it gives me the following error:

"unable to load certificate
15252:error:0909006C:PEM routines:get_name:no start line:crypto\pem\pem_lib.c:745:Expecting: TRUSTED CERTIFICATE
error in x509"

EDIT 2020-12-10 1610 – Snippet of the certificate

-----BEGIN CERTIFICATE REQUEST-----
MIIDGjCCAgICAQAwgaExCzAJBgNVBAYTAkNBMQ8wDQYDVQQIEwZRVUVCRUMxEjAQ
....
hfz1ew0RTMxZv2hMlN/wn5Y0EZKpRr5jMrgZprG7
-----END CERTIFICATE REQUEST-----

I am guessing it should not be listed as a request but as a signed certificate?

EDIT 2020-12-10 1626 EST

UnNamed solved my issue. a big shoutout to them.

in XCA, it's not immediately clear, when you sign a request, that it needs to be exported from a different tab, certificates.

Under the root cert used to sign the users certificate, is a dropdown with the SIGNED user cert. I was able to export it and add it to mmc without issue after creating a custom-view for certificates in it.

Continuing to setup the VPN from here.

Best Answer

The certificate needs to be in the same directory as the openssl.exe or specify the full/absolute path like C:\temp\cert.pem.

The crt file extension is for Windows, the content is base64 PEM format. No need to "convert" the content. Just rename the file extension from .pem to .crt.

Related Topic