I was able to renew one client and one server cert a couple of weeks ago. Today, I attempted to revoke-renewed those certs which failed, although I was able to revoke them manually with openssl. I then tried to renew some expired certs and get: [quote]Easy-RSA error: sign_req - Randomize Serial number failed: Using configuration from /home/norm/easy-rsa/pki/openssl-easyrsa.cnf Easy-RSA error: easyrsa_openssl - Command has failed: * openssl ca -status 3b11ea.... [/quote] The same error occurs if i create new CSRs and attempt to sign-req (whether client or server) I installed haveged (entropy generator) although it seems entropy problems are unlikely these days; it didn't make a difference. I tried a script to rebuild index.txt; no difference. If I manually set up the environment variables, and run [code]openssl ca -config ./openssl-easyrsa.cnf -status (serialnumber)[/code] directly I get nothing back, I don't know if that is expected. Please can anyone help?

[quote=nhenderson@ceml.net post_id=120344 time=1707326137 user_id=55246] when I copied the corresponding line from the old index.txt to the new one, that broke everything [/quote]EasyRSA failed as expected. [quote=nhenderson@ceml.net post_id=120344 time=1707326137 user_id=55246] should this not have worked? [/quote]Please ask OpenSSL. [quote=nhenderson@ceml.net post_id=120344 time=1707326137 user_id=55246] EasyRSA lacks an import function [/quote]EasyRSA has an [b]import[/b] function. Please see the related [b]help[/b]. [quote=nhenderson@ceml.net post_id=120344 time=1707326137 user_id=55246] what I had done wrong, was to try to import a cert and key manually from the earlier PKI structure [/quote]Is it possible that you need to [b]upgrade[/b] from an earlier PKI ? EasyRSA v3.1.7 supports upgrading a PKI. Please see the related [b]help[/b].

EasyRSA fails with sign_req randomize serial number failed

nhenderson@ceml.net

I was able to renew one client and one server cert a couple of weeks ago.
Today, I attempted to revoke-renewed those certs which failed, although I was able to revoke them manually with openssl.

I then tried to renew some expired certs and get:

Easy-RSA error:
sign_req - Randomize Serial number failed:
Using configuration from /home/norm/easy-rsa/pki/openssl-easyrsa.cnf
Easy-RSA error:
easyrsa_openssl - Command has failed:
* openssl ca -status 3b11ea....

The same error occurs if i create new CSRs and attempt to sign-req (whether client or server)

I installed haveged (entropy generator) although it seems entropy problems are unlikely these days; it didn't make a difference.
I tried a script to rebuild index.txt; no difference.

If I manually set up the environment variables, and run

openssl ca -config ./openssl-easyrsa.cnf -status (serialnumber)

directly I get nothing back, I don't know if that is expected.

Please can anyone help?

TinCanTech

What is your Operating System name ?

What is the version of Easy-RSA that you are using ?

nhenderson@ceml.net

Sorry, it's EasyRSA 3.1.7 OpenSSL 1.1.1f Ubuntu 20.04.6 LTS kernel 5.4.0-169-generic

After the above post I initialized a new PKI and copied back in my original ca.crt and ca.key. I was able to generate several requests and sign them. I also revoked a few certs, generated and signed some more.

To cut a long story short: what I had done wrong, was to try to import a cert and key manually from the earlier PKI structure - it's already deployed, with a long end date and I don't want to redeploy. The key and cert were generated with the same ca.key/ca.crt; I put the files in pki/private pki/issued pki/certs_by_serial as appropriate. Permissions all identical and all was fine to that point. However when I copied the corresponding line from the old index.txt to the new one, that broke everything. Deleting the line fixed it.

Since EasyRSA lacks an import function - should this not have worked?

TinCanTech

nhenderson@ceml.net wrote when I copied the corresponding line from the old index.txt to the new one, that broke everything

EasyRSA failed as expected.

nhenderson@ceml.net wrote should this not have worked?

Please ask OpenSSL.

nhenderson@ceml.net wrote EasyRSA lacks an import function

EasyRSA has an import function. Please see the related help.

nhenderson@ceml.net wrote what I had done wrong, was to try to import a cert and key manually from the earlier PKI structure

Is it possible that you need to upgrade from an earlier PKI ?

EasyRSA v3.1.7 supports upgrading a PKI. Please see the related help.