certificate assistant – keychain access – certificate already exists error

[stmoddell]

Howdy,

Posted this question in the web portion of the forum, but realize it isn’t web related, So cross posting here.

—–

Using the article on afp548 for rolling your own CA, I made significant progress in creating a CA. Unfortunately I’ve made a mistake (or three) and now am having trouble getting back to neutral ground.

I have run into one issue which is that I made the mistake originally of creating the server cert (after creating the CA) as self signed. I further compounded that issue by deleting the server cert and its keys. When I created a newer server cert, as a leaf off the CA, I make it thru the entire process, but at the end it fails saying the cert already exists. Unfortunately I can’t figure out how to back out of this corner I’ve painted myself into. I’ve rm’ed the certs from the keychains, and I’ve made sure they aren’t in /etc/certificates, but still will get the same error. I’ve tried creating a new keychain, and still will arrive at same error.

Any advice? Hints?

[stmoddell]

solved this issue, at least functionally. resolution posted on apple discussion forum
http://discussions.apple.com/thread.jspa?messageID=7434613#7434613

[khiltd]

You should really just do this through openssl directly. Keychain Access is terribly broken.

[stmoddell]

any chance you’d provide ‘how to’ instructions, or point at some existing documentation on this?

thus far i found key chain access to work fine for creating the CA, ssl certs, and vpn server cert. Where it has all fallen down is trying to get cert to work on vpn client. From what i’ve been able to find online, it looks like no one is using certificate enabled VPN.

to clarify, I’ve been able to enable server side use of certificates on VPN, but unable to get client side to recognize any kind of certificate for use with VPN.

[khiltd]

[QUOTE][u]Quote by: stmoddell[/u][p]any chance you’d provide ‘how to’ instructions, or point at some existing documentation on this?
[/p][/QUOTE]

The abridged version:

[code]Generate an RSA Key:

openssl genrsa -des3 -out ca.key 2048

Generate a CA:

openssl req -new -x509 -days 365 -key ca.key -out ca.crt

Generate another RSA Key:

openssl genrsa -des3 -out server.key 2048

Generate a Certificate Signing Request:

openssl req -new -key server.key -out server.csr

Sign:

./sign.sh server.csr

Decrypt key:

cp server.key server.key.original
openssl rsa -in server.key.original -out server.key [/code]

Scads of other examples are just a Google away.

[stmoddell]

thank you.

any idea if this will clear up my inability to get certs to work for vpn (client… server will accept a vpn server cert, but can’t get client to recognize any kind of cert for vpn)

[Author]

Posts