4

I'm renewing the certificates for my VPN configuration. When I'm checking the validity:

openssl verify -CAfile keys/ca.crt -verbose keys/example.org.crt
C = XX, ST = XX, L = City, O = Example, OU = Manager, CN = example.org, name = EasyRSA, emailAddress = somemail
error 13 at 0 depth lookup: format error in certificate's notBefore field
error keys/example.org.crt: verification failed

But checking with x509 shows a valid not before:

openssl x509 -in keys/example.org.crt -text Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6 (0x6)
    Signature Algorithm: sha512WithRSAEncryption
        Validity
            Not Before: Mar  4 00:00:00 2017
            Not After : Apr  1 00:00:00 2018

I issued the certificated following tldp guide:

openssl ca -config openssl-1.0.0.cnf -extensions server -days 375 -notext -md sha512 -in keys/example.org.csr -out keys/example.org.crt -startdate 20170304000000 -enddate 20180401000000
Braiam
  • 35,991

1 Answers1

3

When you establish the start/end date, you must set the time zone too! Here's a valid certificate:

Certificate:
    Data:
        Version: 3 (0x2)
        [...]
            Not Before: Mar  5 03:01:35 2016 GMT
            Not After : Mar  5 03:01:35 2017 GMT

The -start/enddate options should be formatted YYMMDDHHMMSSZ, yours lack the final Z.

Braiam
  • 35,991