ssl : Unable to load certificate

ssl certificate pem der
Kat.S picture Kat.S · Apr 12, 2016 · Viewed 93.5k times · Source

I have 2 files - CSR.csr and newkey.key, both seem to be in PEM format as follows -

-----BEGIN CERTIFICATE REQUEST-----

MIID....

-----END CERTIFICATE REQUEST-----

-----BEGIN RSA PRIVATE KEY-----

MI...

-----END RSA PRIVATE KEY-----

When I'm trying to read the CSR.csr file, I get the following error :

$ openssl x509 -in CSR.csr -text -noout
unable to load certificate
140518720210760:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:698:Expecting: TRUSTED CERTIFICATE

I read that we get this error when the input file is in DER format, so I tried the following -

$ openssl x509 -inform DER -in CSR.csr -text -noout

but now I get the error -

unable to load certificate
140519053051720:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1320:
140519053051720:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:382:Type=X509

And it seems this error occurs when the input file is already in PEM format and one tries to read it in DER format.

Really confused how to go about it as I'm new to SSL. Please help!

Answer

Steffen Ullrich picture Steffen Ullrich · Apr 12, 2016

The problem is not PEM vs. DER but that you are using a certificate request in a place where a certificate is expected. This is clearly shown by the PEM header -----BEGIN CERTIFICATE REQUEST-----.

To show the content of a certificate request use 

openssl req -in CSR.csr -text

To show the content of a certificate use

openssl x509 -in CERT.crt -text

Related questions

What are different certificate types, formats in Cryptography

We are adding server certificates verification in SSL handshake for one of our clients. Being very new to Cryptography and C world, thought I would first clear my concepts about these things and then start with implementation. So, I googled …

Read More
convert certificate from pem into jks

I have to convert a certificate in pem format into an java key store. To use this one with tomcat at a windows server I've got those files: cert_request.csr -----BEGIN CERTIFICATE REQUEST----- ... -----END CERTIFICATE REQUEST----- cert_public_key.…

Read More
How can I decode a SSL certificate using python?

How can I decode a pem-encoded (base64) certificate with Python? For example this here from github.com: -----BEGIN CERTIFICATE----- MIIHKjCCBhKgAwIBAgIQDnd2il0H8OV5WcoqnVCCtTANBgkqhkiG9w0BAQUFADBp MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSgwJgYDVQQDEx9EaWdpQ2VydCBIaWdoIEFzc3VyYW5j ZSBFViBDQS0xMB4XDTExMDUyNzAwMDAwMFoXDTEzMDcyOTEyMDAwMFowgcoxHTAb BgNVBA8…

Read More