HTTPS Client certificate error ERR_SSL_SERVER_CERT_BAD_FORMAT

问题

I'm trying to use a client HTTPS certificate system in node. Here what I did to generate ssl files :

# CA Key and Certificate
openssl genrsa -aes256 -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key -out ca.crt

# Create the Server Key CSR and Certificate
openssl genrsa -aes256 -out server.key 4096
openssl req -new -key server.key -out server.csr

# Self Signing
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

# Create the Client Key and CSR
openssl genrsa -aes256 -out client.key 4096
openssl req -new -key client.key -out client.csr

# Sign client certificate
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt

# Pack client key and certificate to be used in browsers
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

# Remove password from server key
openssl rsa -in server.key -out server.key.nopwd && mv server.key.nopwd server.key

Then I'm using the following code (using express) in node :

let server = https.createServer({
    key               : fs.readFileSync('./ssl/server.key'),
    cert              : fs.readFileSync('./ssl/server.crt'),
    ca                : fs.readFileSync('./ssl/ca.crt'),
    requestCert       : true,
    rejectUnauthorized: false
}, app);

appbeing the express application. I then use listenfunction. After adding the p12 file to Chrome, when I navigate on my website here the error I get : ERR_SSL_SERVER_CERT_BAD_FORMAT

Could someone tell me what I missed ?

Note : I have often error in Chrome when I try to add the p12 file : Unknown Error. I don't remember how I managed to get it working to get ERR_SSL_SERVER_CERT_BAD_FORMAT

回答1:

Fact is, serial number must be unique. cURL doesn't care, browser do. You can use :

# CA Key and Certificate
openssl genrsa -aes256 -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key -out ca.crt

# Create the Server Key CSR and Certificate
openssl genrsa -aes256 -out server.key 4096
openssl req -new -key server.key -out server.csr

# Self Signing
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

# Create the Client Key and CSR
openssl genrsa -aes256 -out test.key 4096
openssl req -new -key test.key -out test.csr

# Sign client certificate
openssl x509 -req -days 365 -in test.csr -CA ca.crt -CAkey ca.key -set_serial 02 -out test.crt

# Pack client key and certificate to be used in browsers
openssl pkcs12 -export -clcerts -in test.crt -inkey test.key -out test.p12

# Remove password from server key
openssl rsa -in server.key -out server.key.nopwd && mv server.key.nopwd server.key

来源：https://stackoverflow.com/questions/32258589/https-client-certificate-error-err-ssl-server-cert-bad-format

标签

node.js

ssl

certificate

client