创建 SSL 证书时遇到问题
我正在尝试使用 certutil 为运行 Sun Webserver 6.1 的测试 Web 服务器创建自签名证书。如果有人有更好的使用 Sun Webserver 的说明，我愿意使用 keytool 或 openssl。
以下是我使用的命令：
certutil -S -P "https-myWebapp-" -d . -n myCA -s "CN=myWebserver.com CA,OU=myCompany,C=US" -x -t "CT,CT,CT" -m 102 -v 301 -5
我选择选项 5 - SSL CA，并对关键扩展问题选择“是”。 CA创建成功。现在我已经创建了证书颁发机构，我尝试使用以下命令签署实际证书：
certutil -S -P "https-myWebapp-" -d . -n myServer -s "CN=myWebserver.com,C=US" -c myCA -t "u,u,u" -m 102 -v 300 -5
在 certutil 提示符下，我选择选项 1 创建启用了关键扩展的 SSL 服务器。这会产生以下错误：
certutil: could not obtain certificate from file: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.
我做错了什么？我认为我的 SSL 证书可能失败，但在运行 certutil -L -d 时收到以下信息。 -P“https-myWebapp-”
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
myCA CTu,Cu,CuI'm trying to create a self-signed certificate for a test web server running Sun Webserver 6.1 using certutil. I am open to using keytool or openssl if someone has better instructions which work with Sun Webserver.
Here are the commands that I use:
certutil -S -P "https-myWebapp-" -d . -n myCA -s "CN=myWebserver.com CA,OU=myCompany,C=US" -x -t "CT,CT,CT" -m 102 -v 301 -5
and I select option 5 - SSL CA and "yes" to the critical extension question. The CA is created successfully. Now that I have created the certificate authority, I try to sign the actual cert with the following command:
certutil -S -P "https-myWebapp-" -d . -n myServer -s "CN=myWebserver.com,C=US" -c myCA -t "u,u,u" -m 102 -v 300 -5
At the certutil prompt, I select option 1 to create a SSL server with critical extensions enabled. This produces the following error:
certutil: could not obtain certificate from file: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.
What did I do wrong? I think that I may have a failed SSL certificate, but I get the following when running certutil -L -d . -P "https-myWebapp-"
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
myCA CTu,Cu,Cu如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在第二个命令中，我需要将 -m 属性更改为新的序列 ID 号。
这修复了错误消息并创建了证书。
In the second command, I needed to change the -m property to a new serial id number.
That fixed the error message and created the certificate.