CA证书的basicConstraints扩展名不为true

Question

我正在关注创建自签名证书的AWS GUIDE.但在创建我的CA之后,我尝试将其上传到AWS IOT我收到此错误:

命令:

aws iot register-ca-certificate --ca-certificate file://CA_cert.pem --verification-cert file://verificationCert.crt

错误:

An error occurred (CertificateValidationException) when calling the RegisterCACertificate operation: CA certificate is not valid. The CA certificate does not have the basicConstraints extension as true

任何帮助赞赏!

Answer 1

我也使用了AWS IoT并遇到了同样的错误,我找到了解决方案.

错误的原因

发生此错误的原因basicConstraints是CA证书中的扩展,这意味着证书是CA,因此此证书能够签署其他公钥以生成客户端证书,未设置为TRUE.

请注意,客户端X的证书包含由CA的私钥签名的X的公钥.其他客户端(例如Y)可以使用CA的公钥验证X的公钥.

我认为您在尝试生成CA证书时遇到错误.该错误消息表明不允许CA的证书签署其他客户端公钥.

以下是我的表现.

解

我假设你已经生成了CA的密钥rootCA.key.

我们需要一个openssl配置文件rootCA_openssl.conf.请注意,您可以修改值.

[ req ]
distinguished_name       = req_distinguished_name
extensions               = v3_ca
req_extensions           = v3_ca

[ v3_ca ]
basicConstraints         = CA:TRUE

[ req_distinguished_name ]
countryName              = Country Name (2 letter code)
countryName_default      = KR
countryName_min          = 2
countryName_max          = 2
organizationName         = Organization Name (eg, company)
organizationName_default = Deeply Inc.

然后使用配置文件生成CA的证书rootCA_openssl.conf.

openssl req -new -sha256 -key rootCA.key -nodes -out rootCA.csr -config rootCA_openssl.conf
openssl x509 -req -days 3650 -extfile rootCA_openssl.conf -extensions v3_ca -in rootCA.csr -signkey rootCA.key -out rootCA.pem 

现在我们有CA的证书rootCA.pem.然后,您可以按照AWS IoT文档中的说明进行操作.例如:

# Get the registration code for the use below: 
# $ aws iot get-registration-code 

openssl genrsa -out verificationCert.key 2048

openssl req -new -key verificationCert.key -out verificationCert.csr
# Put the registration code in Common Name field

openssl x509 -req -in verificationCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out verificationCert.crt -days 500 -sha256