Apache SSL Certificate configuration - sec_error_inadequate_cert_type

Question

I think i messed up a little with my SSL certificates. We are using SSL Certificates for all OpenVPN clients (witch works perfectly), generated using the easy-rsa toolkit.

And now i want to use the same certificates for Web servers on the OpenVPN hosts

All Keys are 4096 bit long.

My idea is that mybe the Usage purpose is wrong for apache, but i am not quite sure.

root@howard~# openssl x509 -in howard.example.com.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 15 (0xf)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AT, ST=STMK, L=Graz, O=Bee Company, OU=Root CA, CN=example.com/name=rootca/[email protected]
        Validity
            Not Before: Aug 13 12:36:41 2013 GMT
            Not After : Aug 11 12:36:41 2023 GMT
        Subject: C=AT, ST=STMK, L=Graz, O=example.com.at, OU=changeme, CN=howard.example.com/name=howard.example.com/[email protected]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    NOTHING_TO_READ_HERE :)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                Easy-RSA Generated Certificate
            X509v3 Subject Key Identifier:
                NOTHING_TO_READ_HERE :)
            X509v3 Authority Key Identifier:
                keyid:NOTHING_TO_READ_HERE :)
                DirName:/C=AT/ST=STMK/L=Graz/O=Bee Company/OU=Root CA/CN=example.com/name=rootca/[email protected]
                serial:NOTHING_TO_READ_HERE :)

            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Key Usage:
                Digital Signature
    Signature Algorithm: sha1WithRSAEncryption

I have no idea how to change/add the purpose of a key when i am generating it with the easy-rsa toolkit.

All i do when generating a new OpenVPN certificate:

cd /usr/share/doc/openvpn/examples/easy-rsa/2.0/
vi vars
. ./vars
./build-key CLIENTNAME

And inside the vars file i couldn't find anything.

But Firefox is returning an

sec_error_inadequate_cert_type

Microsoft's IE just prompts me over and over again if I really trust this certificate...

Any ideas on what i did wrong, or what i need to do?

My idea would be that apache cant handle 4096 bit Keys...

Community · Accepted Answer · 2017-03-17 13:14:46Z

5

Your key usage and extended key usages are clearly not for a TLS server:

        X509v3 Extended Key Usage:
            TLS Web Client Authentication
        X509v3 Key Usage:
            Digital Signature

For a web server you'd obviously want the "TLS Web Server Authentication" extended key usage.

For the key usage, it's less obvious, but you'd want the Key Encipherment too.

More details:

NSS Tech Note 3
These questions on Security.SE: Extensions for SSL server certificate and Which key usages are required by each key exchange method?

edited Mar 17, 2017 at 13:14

CommunityBot

11 silver badge

answered Aug 14, 2013 at 9:37

Bruno

123k33 gold badges278 silver badges389 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Daywalker Over a year ago

Thank you, but do you have a short hint how i would create certificates with the easy-rsa toolkit i am using? or how should create a new certificate by hand (with openssl) witch could server all purpose OpenVPN and as a (Web)Server Certificate?

Bruno Over a year ago

I'm not sure about easy-rsa, but perhaps you could try with XCA instead, you may find it easier to use.

Daywalker Over a year ago

thank, you! I would vote you up if i'd had enough reputation score :)

Oliver Matthews · Accepted Answer · 2013-12-04 12:51:33Z

1

Actually, you can do this with easy-rsa - just use build-key-server rather than build-key

answered Dec 4, 2013 at 12:51

Oliver Matthews

7,9033 gold badges37 silver badges37 bronze badges

1 Comment

Daywalker Over a year ago

Thank your for that hint, this was the additional solution for my problem (which i caused by myself :) )

gilb_4 · Accepted Answer · 2013-12-21 23:39:36Z

0

I have run into the same issue but by fooling around with the openssl.config included in OpenVPN easyrsa I have found that you can use the ./build-key-server script (sorry If I am not accurate but I am using OpenVPN over Windows) works like a charm :)

answered Dec 21, 2013 at 23:39

gilb_4

1

Collectives™ on Stack Overflow

Apache SSL Certificate configuration - sec_error_inadequate_cert_type

3 Answers 3

3 Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related