generate CA with startdate

fede_home

Hi all,
I have a strange problem and I need help. I have some trivial devices connected with my server via openvpn. The problem is when these devices reboot, they lost the actual date-time and the restart with clock on 01/01/1970 !!
Ok, this is not blocking problem, but when the vpn on these devices check the "Not Before" filed on certification authority certificate, they say "certificate not yet available".
So now, how can I create a ca.crt with the "Not Before" files set by hand ?
I tried the script buid-ca, and change the openssl-1.0.0.cnf config file, but as starttime they use the actual date.
Can anyone help me ?

Federico

maikcat

you can always turn back your clock when you generate certificates 😉

or

is there any chance that this devices have ntp client?

Michael.

fede_home

:lol:
No, It's a little bit complicate to explain but I really need to generate ca certificate with my own startdate.

janjust

in the 'pkitool' script , change the lines

352 ( [ $DO_CA -eq 0 ] || $OPENSSL ca $BATCH -days $KEY_EXPIRE -out "$FN.crt" \
353 -in "$FN.csr" $CA_EXT -md sha1 -config "$KEY_CONFIG" ) && \

352         ( [ $DO_CA -eq 0 ]  || $OPENSSL ca $BATCH -startdate YYMMDDHHSSZ -days $KEY_EXPIRE -out "$FN.crt" \
353             -in "$FN.csr" $CA_EXT -md sha1 -config "$KEY_CONFIG" ) && \

(note the Z at the end of the date)

fede_home

Hi janjust,
I did it but it doesn't work. I think the ca certificate is generated at line 328. I think this line generates the request and the certificate too.
The lines 352 and 353 are only for server and user keys.

janjust

ai, that one is trickier to change... the CA is generated as a self-signed cert. you would have to change the way the CA.crt is generated: don't use 'openssl req' , try the 'openssl ca' command instead...