konklone / shaaaaaaaaaaaaa

Check if a website has weak SHA-1 TLS certificates.
https://shaaaaaaaaaaaaa.com
BSD 3-Clause "New" or "Revised" License
207 stars 27 forks source link

Example CSR command doesn't work #51

Closed alanorth closed 9 years ago

alanorth commented 9 years ago

On Arch Linux with OpenSSL 1.0.1i and CentOS 6.5 OpenSSL 1.0.1e-fips:

$ openssl req -new -newkey -sha256 -key your-private.key -out your-domain.csr                                            
Error opening Private Key your-private.key
140369978603152:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('your-private.key','r')
140369978603152:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load Private Key

For reference, I was able to buy a SHA2 cert from Namecheap (Comodo PositiveSSL) using this:

openssl req -new -newkey rsa:2048 -nodes -sha256 -out your-domain.csr -keyout your-domain.key
konklone commented 9 years ago

Right, the command I use implies you've already generated a private key file, and that you would change out the your-private.key filename for our actual key. I tweaked the text in 0ef2d30 to make this clearer.

konklone commented 9 years ago

To be clear, your command is more self-contained, but I'm expecting the end users here to be re-issuing, not creating a key for the first time, and I'm trying to keep that section brief. Open to other changes I can make to make this all clearer.

alanorth commented 9 years ago

Ah, yes. Great! Cheers.

nszceta commented 9 years ago

This is still a problem.

On Amazon Linux 2015.3 I ran into the same problem as the original poster.

However, I got things to work with this:

openssl req -new -nodes -sha256 -out my-domain.csr -keyout my-domain.key

Go figure, haha