openssl: No certificate matches private key / chained certificate

openssl certificate chained
user643605 picture user643605 · Jul 30, 2011 · Viewed 9.5k times · Source

I am getting this error while binding a chained certificate with a private key:

"No certificate matches private key"

the command I use is the following:

openssl pkcs12 -export -in chainedcertificate.pem -inkey private.pem -name MyCert -out chained.p12

Inside my chainedcertificate.pem is three blocks of BEGIN/END CERTIFICATE. CA, Intermediate and user certificate are in the file in reverse order (i.e. CA being last).

When I remove the the two last blocks and leave only the user certifcate, the chained.p12 is generated without any error.

Why would the insertion of the root certificate and intermediate would compromise the creation with this kind of error message ???

Answer

Dilettant picture Dilettant · Jul 30, 2011

I think you need to provide the user cert first drilling deeper until the CA is reached at the end of the file. At least I would try this. Maybe I misread your description of the actual order you selected.

Related questions

How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Using openssl to get the certificate from a server

I am trying to get the certificate of a remote server, which I can then use to add to my keystore and use within my java application. A senior dev (who is on holidays :( ) informed me I can run this: …

Read More
OpenSSL: PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE

I need a hash-name for file for posting in Stunnel's CApath directory. I have got some certs in this directory and they are working well. Also, I have a server sert and server key: cert = c:\Program Files (x86)\stunnel\…

Read More