"Error opening CA private key" on Windows

openssl certificate ssl-certificate certificate-authority
Slav picture Slav · Oct 6, 2014 · Viewed 11.7k times · Source

I am running on Windows Server 2003, and installed Win64 OpenSSL v1.0.1i Light

No matter what guide I follow to set it up, I always end up with the following error when trying to actually sign a certificate

openssl ca -in my.csr -out my.cert.pem

Using configuration from C:\OpenSSL-Win64\bin\openssl.cfg
Loading 'screen' into random state - done
Error opening CA private key ./myCA/private/myCA.key.pem
1776:error:02001003:system library:fopen:No such process:.\crypto\bio\bss_file.c:398:fopen('./myCA/private/myCA.key.pem','rb')
1776:error:20074002:BIO routines:FILE_CTRL:system lib:.\crypto\bio\bss_file.c:400:
unable to load CA private key

The paths to the key exist (triple and quadruple checked).
However I don't know what is this .\crypto\ that it's looking for.

I did not have this issue using pre-installed Mac OS's openssl, so makes me think there is an environment pre-requisite that is missing...

Answer

pepo picture pepo · Oct 6, 2014

The path to myCA.key.pem is relative so it depends from which directory you run openssl. If your working directory is C:/OpenSSL-Win64/bin/ then the path to private key of CA should be C:/OpenSSL-Win64/bin/myCA/private/myCA.key.pem

Related questions

How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Using openssl to get the certificate from a server

I am trying to get the certificate of a remote server, which I can then use to add to my keystore and use within my java application. A senior dev (who is on holidays :( ) informed me I can run this: …

Read More
How does an SSL certificate chain bundle work?

I've created a chain hierarchy like this. root-ca ==> signing-ca ==> subordinate-ca ==> server It is mentioned to create chain bundle, the lowest should go first. $ cat server.crt subordinate-ca.crt signing-ca.crt > server.pem But verification fails. $ openssl …

Read More