I am using Ubuntu and OpenSSL to generate an SSL CA with a Server and Client Key/Cert. The problem is: as soon as i enter an FQDN while generating it the ssl verification failed.
I use this commands to generate the root CA:
openssl genrsa -aes256 -out ca-key.pem 2048
openssl req -x509 -new -nodes -extensions v3_ca -key ca-key.pem -days 1024 -out ca-root.pem -sha512
I use this commands to generate the certificates:
openssl genrsa -out zertifikat-key.pem 4096
openssl req -new -key zertifikat-key.pem -out zertifikat.csr -sha512
openssl x509 -req -in zertifikat.csr -CA ca-root.pem -CAkey ca-key.pem -CAcreateserial -out zertifikat-pub.pem -days 365 -sha512
I copy the root CA to /usr/local/share/ca-certificates/
an run sudo update-ca-certificates to load them (This works, it shows me that 1 key is added)
I use this command this command to verify:
openssl verify -CAfile ca-root.pem zertifikat-pub.pem
i know there is a way to pass the verification check even and ignore it is self signed, but in my case i need to pass it.
As said this only happens if i pass a FQDN/CN in the Server or Client Certificate, otherwise it passes verification.