How to create a self signed certificate with openssl?

[LM-Rafael]

Hello everyone,

I'm trying to create a self-signed certificate using OpenSSL, but I keep running into an issue where the certificate is recognized as invalid.

I followed these steps to create the certificate:

1. Generating the Private Key

   openssl genrsa -out my_private.key 2048

2. Creating the Certificate Signing Request (CSR)

   openssl req -new -key my_private.key -out my_request.csr

   I filled in the required details like Common Name (CN), organization, and location.

3. Creating the Self-Signed Certificate

   openssl x509 -req -in my_request.csr -signkey my_private.key -out my_certificate.crt -days 365 -sha256

4. Converting to PFX for Import

   openssl pkcs12 -export -out my_certificate.pfx -inkey my_private.key -in my_certificate.crt -passout pass:MySecurePassword

Everything seems to be correct, but when I try to use the certificate, my system or application says it is invalid.

I checked the certificate details with:

openssl x509 -in my_certificate.crt -noout -text

The output seems fine, but it still doesn’t work.

Could the issue be related to a missing CA certificate, incorrect signing, or something else in my OpenSSL setup?

I’d really appreciate any help or advice on what could be causing this. Has anyone else experienced this problem?

Thanks in advance!

Rafael

[Lesley]

Maybe it is a stupid comment. But for me it is normal an application / browser will give a warning because it is self-signed. 

And with system you mean a Check Point device? Because I don't see how it is related yet. 

[LM-Rafael]

Sry.

I want to upload the self-signed certificate to my 1600 appliance. But i get from the appliance web interface the error message: "Invalid Certificate or Password is Wrong". But the Password is correct!

[the_rock]

Maybe wrong cert extension?

Andy

[the_rock]

Reason @LM-Rafael why I asked last question about extension of the cert is because whenever you try to upload any sort of cert, regardless if its for the fw or anything else, it will always come up with predefined (for the lack of the better word) extension, so say if you see .p12 there, then certificate HAS TO be in that format, nothing else would work.

Hope that helps.

Andy

[Lesley]

I think you have to upload a .p12

Atleast in SmartConsole it is always a .p12. I assume this is locally managed? 

[the_rock]

I think so too Lesley. Thats the only extension I ever see when trying to upload fw cert.

Andy

[AkosBakos]

Hi @LM-Rafael 

I usually user XCA to handle certificates.

https://hohnstaedt.de/xca/

This is really good tool

Akos

[G_W_Albrecht]

How to get a .p12 certificate can be found in https://support.checkpoint.com/results/sk/sk170395