SSL error opening input file - Configure SSL for a WLC5500

[dianipsu3624]

Hello,

I am trying to Configure SSL for a Cisco Wireless LAN Controller 5508 but when I type the follow command appears error opening input file:

OpenSSL> pkcs12 -export -in All-certs.pem -inkey mykey.pem -out All-certs.p12 -clcerts -passin pass:check123 -passout pass:check123
Loading 'screen' into random state - done
Error opening input file All-certs.pem
All-certs.pem: No error
unable to write 'random state'
error in pkcs12

Any suggests?

Thanks a lot

[Flavio Miranda]

Hi,

  I used the following command and it worked:

pkcs12 -in file.pfx -out final.pem -passin pass:XXXXXX  -passout pass:XXXXXX

-If I helped you somehow, please, rate it as useful.-

[dianipsu3624]

Finally I can execute the commands:

OpenSSL> pkcs12 -export -in All-certs.pem -inkey mykey.key -out All-certs.p12 -clcerts -passin pass:check123 -passout pass:check123
Loading 'screen' into random state - done

OpenSSL> pkcs12 -in All-certs.p12 -out final.pem -passin pass:check123 -passout pass:check123
MAC verified OK

But when I try to install the certificate appears error:

TFTP receive complete... Installing Certificate.

*spamApTask7: Jan 30 14:34:36.375: OpenSSL Get Issuer Handles: CSCO user cert not verified by Cisco Roots ...

*TransferTask: Jan 30 14:41:26.945: Add WebAuth Cert: Adding certificate & private key using password check123

*TransferTask: Jan 30 14:41:26.947: Add ID Cert: Adding certificate & private key using password check123

*TransferTask: Jan 30 14:41:26.947: Add Cert to ID Table: Adding certificate (name: bsnSslWebauthCert) to ID table using password check123

*TransferTask: Jan 30 14:41:26.947: Add Cert to ID Table: Decoding PEM-encoded Certificate (verify: YES)

*TransferTask: Jan 30 14:41:26.947: Decode & Verify PEM Cert: Cert/Key Length was 0, so taking string length instead

*TransferTask: Jan 30 14:41:26.947: Decode & Verify PEM Cert: Cert/Key Length 9016 & VERIFY

*TransferTask: Jan 30 14:41:26.956: Decode & Verify PEM Cert: X509 Cert Verification return code: 0

*TransferTask: Jan 30 14:41:26.956: Decode & Verify PEM Cert: X509 Cert Verification result text: unable to get issuer certificate

*TransferTask: Jan 30 14:41:26.956: Decode & Verify PEM Cert: Error in X509 Cert Verification at 2 depth: unable to get issuer certificate

*TransferTask: Jan 30 14:41:26.958: Add Cert to ID Table: Error decoding (verify: YES) PEM certificate

*TransferTask: Jan 30 14:41:26.958: Add ID Cert: Error decoding / adding cert to ID cert table (verifyChain:

[ajc]

Send me a message so I can provide you a procedure to install the cert step by step. I do not follow Cisco doc because it is confusing. Openssl is required on your laptop.

[patoberli · Accepted solution]

Did you first install the Root/issuer Cert, or chain it into the final cert?
If I remember correctly, the whole chain needs to be inside the certificate.
> Decode & Verify PEM Cert: X509 Cert Verification result text: unable to get issuer certificate

[dianipsu3624]

Hello,

The problem was that the Root certificate that came in the chain sent by the certifying entity did not match the public certificate found on the certification authority's page. Once this certificate was corrected and the process was carried out again, it worked correctly.

Thanks a lot to all.

[Flavio Miranda]

Good to know and thanks for update. This makes the forum lot better.