Menu
I have SSL certificate ( key.pem, cacert.pem, pcert.pem ) generated with OpenSSL on Linux Mint machine. Now I'm trying to move my application to another server where is installed Fedora 18 with NSS.
cURL is returning this error:
unable to load client key: -8178 (SEC_ERROR_BAD_KEY)
I tested again and on my computer is working fine but on server not. I think it's because I used OpenSSL to generate certificates but on server is installed NSS.
I can't find how to generate certificates with "certutil" or with "openssl" to be valid with NSS.
696
This section covers OpenSSL commands that are related to generating CSRs (and private keys, if they do not already exist). CSRs can be used to request SSL certificates from a certificate authority.
The second most common reason why a website may show insecure although you installed an SSL Certificate on it is that your server is outdated and/or doesn’t support the latest TLS settings requirements.
Also, many of these formats can contain multiple items, such as a private key, certificate, and CA certificate, in a single file. OpenSSL can be used to convert certificates to and from a large variety of these formats. This section will cover a some of the possible conversions.
If you would like to use an SSL certificate to secure a service but you do not require a CA-signed certificate, a valid (and free) solution is to sign your own certificates. A common type of certificate that you can issue yourself is a self-signed certificate. A self-signed certificate is a certificate that is signed with its own private key.
The failure was due to my PKCS#8 private key format:
- With a PKCS#8 private key-----BEGIN ENCRYPTED PRIVATE KEY----- header
or-----BEGIN PRIVATE KEY----- header
curl+openssl works, but not curl+nss+libnsspem.so
- With a RSA private key-----BEGIN RSA PRIVATE KEY----- header
both curl+openssl and curl+nss+libnsspem.so work.
So use this command openssl rsa -in key.pem -out newkey.pem to remove the pass phrase on an RSA private key:
66
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
