title: "an introduction to openssl programming." article. expired certificates
body: <p>I am newbie in openSSL library and PKI .
  I have simple question for openSSL experts.</p>
  
  <p>Does anybody know how to create certificates for code samples in this article 
  "An Introduction to OpenSSL programming (Part I/II)" by Eric Rescorla</p>
  
  <p>www.rtfm.com/openssl-examples/part1.pdf</p>
  
  <p>www.rtfm.com/openssl-examples/part2.pdf</p>
  
  <p>I  have downloaded source code from <a href="http://www.rtfm.com/openssl-examples" rel="nofollow">http://www.rtfm.com/openssl-examples</a>
  The problem is that certificates are expired and I don't know how to create new root certificate.</p>
  
  <p>How to create root certificate? How to create certificates for client and server app? Wich ciphering algorithm should I use? 
  As far as i understand i shuld do the following:</p>
  
  <ul>
  <li>Create key pair. Secret and public keys.</li>
  <li>Create certificate request (p10 format).</li>
  <li>Create selfsigned root sertificate (x509 format).</li>
  </ul>
  
  <p>Details is not clear from the article. </p>
  
  <p>This is how I am trying to create certificates:</p>
  
  <p>1) Creating CA private key and certificate request:
  openssl req -newkey rsa -keyout ./ca_key.pem out.pem -out ./ca_req.pem -days 1095 -passin pass:"password" -subj "some information about CA" -extensions v3_ca</p>
  
  <p>2) Create self signed CA certificate
  openssl ca -create_serial -in ca_req.pem -out root.pem -days 1095 -passin pass:"password" -selfsign -extension v3_ca</p>
  
  <p>3)generate server private key and request for certificate
  openssl req -newkey rsa -keyout server_key.pem out server_req.pem -days 1095 -passin pass:"password" -subj "some information about server" </p>
  
  <p>4)create server certifiate (this certificate is not self signed. This certificate signed by CA private key)
  openssl ca -in server_req.pem -out server.pem -passin pass:"password"</p>
  
  <p>5)generate user private key and request for certificate
  openssl req -newkey rsa -keyout user_key.pem out user_req.pem -days 1095 -passin pass:"password" -subj "some information about client" </p>
  
  <p>6)create user certifiate (this certificate is not self signed. This certificate signed by CA private key)
  openssl ca -in user_req.pem -out client.pem -passin pass:"password"</p>
  
  <p>I am not sure about "rsa" algorithm here. May be I shuold use other algorthm.</p>
  
  <p>So i have root.pem, server.pem, client.pem
  I put client key and certificate to client.pem 
  And the same thing for server.pem. ( The same way as in the articles sample certificates.)</p>
  
  <p>But when i try to start server with these new generated certificates i have an error:
  "Couldn't open DH file."</p>
  
  <p>When I put old DH file to current folder and server starts.
  (dh1024.pem  What is it?)</p>
  
  <p>The next step.  I start client and I got another error message: "Cetrificate doesn't verify."</p>
  
  <p>The error code is 20. Desciption for code 20 in x509_vfy.h is "unable to get issuer certificate locally"</p>
  
  <p>All of this means that I have created certificates incorrectly.
  I don't know how to do it correctly.</p>
  
  <p>Does anybody have an idea?</p>