Contents

Introduction

Solution

Introduction

When adding the contents from the certificate file, Threatgrid appliance does not accept the certificate and displays an error that this is "Not a client/server CA cert" and the error is seen as below:

Solution

It is possible that the certificate in question does not have the required extensions in order to be accepted by the Threatgrid appliance. For the CA certificate to be accepted by the threatgrid, it must have the correct CA extensions. In order to check this:

Step 1: In order to verify the certificate, you may execute this openssl command.

openssl x509 -in poke.fireamp.pem -text

Step 2: The content as seen here is:

Certificate:

Data:

Version: 1 (0x0)

Serial Number: 0 (0x0)

Signature Algorithm: sha256WithRSAEncryption

Issuer: C = IN, ST = KA, O = MYLAB, OU = MYLAB, CN = root.mylab.com

Validity

Not Before: Jun  3 08:55:34 2020 GMT

Not After : May 29 08:55:34 2040 GMT

Subject: C = IN, ST = KA, O = MYLAB, OU = MYLAB, CN = dispupd-master3.mylab.com

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

RSA Public-Key: (2048 bit)

Modulus:

00:9f:4c:cc:c1:0c:bb:88:b0:fb:c0:68:19:a2:36:

e4:29:4d:ef:68:23:e2:69:0f:d6:b7:96:7e:f8:80:

7a:1f:76:97:42:a4:a0:a5:26:2f:b6:06:67:14:26:

df:ab:50:c0:fc:ec:e4:02:7b:ca:86:cf:99:8e:43:

1d:d3:51:4b:0a:7e:ca:46:5a:9f:f2:68:ae:3d:c5:

a1:ab:3b:bb:c3:83:c3:a1:61:83:1e:1e:d6:ab:13:

a3:b1:51:b0:15:f4:a1:11:89:e6:79:0f:ae:89:6b:

5b:ec:74:4d:75:00:60:59:06:49:f1:f5:7c:b8:70:

67:29:fc:fb:81:88:cd:cf:a9:6e:8f:b6:02:b1:58:

02:8c:41:73:9f:7c:fc:9b:37:b4:1f:bd:28:7b:ca:

90:5e:97:7f:4f:40:0e:be:e3:55:cc:dc:32:fb:5a:

ef:c0:40:83:ab:20:c5:28:c1:ca:c5:54:b5:c3:87:

ec:79:be:6e:46:e5:44:56:fc:ab:9b:5f:f5:a3:8b:

06:e3:b3:29:09:bd:76:96:ba:22:09:85:c5:e2:50:

e2:d9:10:f2:58:42:be:99:be:5f:6c:eb:82:dc:3e:

d0:d3:a5:b4:c6:d5:7a:e6:1a:e8:cc:dc:19:b9:c8:

0c:8c:8c:87:a5:d5:0d:d1:d4:1b:a6:14:4f:29:68:

82:cf

Exponent: 65537 (0x10001)

Signature Algorithm: sha256WithRSAEncryption

4a:1f:00:60:fe:0b:0b:e0:02:f8:85:6e:ff:e6:73:92:7a:3f:

4c:46:89:36:84:51:f1:f8:73:9a:b6:6e:83:54:92:48:f4:df:

df:10:d8:c4:f2:36:38:fd:0e:1b:9c:ef:f7:91:c3:90:db:cc:

ec:84:a0:45:9b:35:85:d9:39:10:e6:01:e9:6c:ab:29:c7:0b:

57:12:b4:cb:bd:cf:ae:1c:3a:ff:a1:7d:b7:d4:b2:98:53:7b:

d9:25:11:40:72:1b:ce:90:dd:3e:c8:3c:9f:bf:5b:f5:78:d0:

be:66:b9:d2:ed:d3:c8:71:1d:75:b7:29:37:17:5f:e3:63:68:

51:1d:30:7b:1d:45:67:b2:71:61:59:39:26:19:aa:87:d7:f1:

07:b1:3b:68:b0:1a:5a:9f:61:e3:55:ae:31:80:dc:46:e5:4a:

46:f7:12:6b:1b:8f:b5:68:bf:00:56:66:6a:c6:b2:d9:7a:ea:

61:de:15:72:eb:3b:49:d1:55:bc:9d:6c:8b:05:36:82:f7:b8:

12:ac:c9:f0:e9:1c:8b:60:2d:cf:61:8b:4f:7c:3f:89:e0:05:

e4:58:a8:22:13:74:76:7a:86:20:b2:8c:ae:cc:68:28:56:63:

df:ac:85:29:5b:e4:2b:8e:98:36:75:71:6f:48:3a:af:4c:8f:

4e:57:c5:ce

Step 3:This indicates that the CA extensions are not present. These are the expected extensions to be seen on the CA certificate.

X509v3 Basic Constraints: critical

CA:TRUE

Step 4: Ensure that the certificate has these extensions available, and if not, you will have to ask your certificate provider to share the CA certificate with these extensions. If you've created your certificate with OpenSSL, these commands will help you to generate the CA certificate with correct extensions.

openssl genrsa -out rootCA.key 2048

openssl req \

-addext basicConstraints=critical,CA:TRUE\

-outform pem -out rootCA.pem \

-key rootCA.key -new -x509 \

-days "1000"

Step 5: Here's an example of what an acceptable certificate looks like:

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

56:e4:2f:5a:f3:21:e2:17:43:13:cb:21:b3:30:16:cb:37:12:54:c6

Signature Algorithm: sha256WithRSAEncryption

Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd

Validity

Not Before: Nov 17 08:50:01 2020 GMT

Not After : Aug 14 08:50:01 2023 GMT

Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

RSA Public-Key: (2048 bit)

Modulus:

00:cb:1a:3d:db:4f:5d:15:4f:e7:75:37:ae:ac:a4:

dc:de:9d:67:34:6d:ca:d4:9a:e4:26:73:d0:08:90:

0f:0d:bc:16:0f:9c:bb:7d:7e:e0:39:36:78:0f:19:

b0:c1:6a:20:33:96:f9:70:f0:7d:33:74:79:8a:a1:

f8:aa:a4:81:50:dc:e7:5a:b7:4d:6a:4a:d6:aa:5a:

59:d7:58:05:1c:14:d3:03:01:c5:cd:ce:a5:bd:68:

be:c2:31:e1:3a:75:58:f3:5f:fe:c2:38:4e:5f:df:

be:9b:ad:e5:a0:81:41:41:ff:45:90:3c:20:1c:5b:

35:0b:9e:8c:79:49:f6:da:c0:85:df:6f:b7:e3:2c:

e4:fc:2e:08:ff:97:f3:e0:10:ff:3f:79:92:c9:19:

ee:96:46:2c:07:bc:b4:16:88:f3:0e:98:dd:4e:07:

e6:7c:34:9d:a9:71:5a:61:a3:ba:d5:d1:a1:0f:e9:

e2:7d:45:71:36:6e:2d:57:ee:0b:1a:80:c3:e8:76:

29:ed:e2:25:94:0b:4f:9d:01:35:fa:b9:91:e4:1f:

00:17:54:46:d1:2d:62:a1:7c:a2:bd:e0:67:fc:43:

c0:55:e7:82:86:88:34:11:66:0b:85:1a:c5:c0:87:

ce:eb:b8:47:6d:4b:24:cd:4a:ab:e1:90:5f:1f:89:

10:a1

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Subject Key Identifier:

5C:2D:62:32:41:0A:5C:EB:4C:CF:41:A9:FB:81:F9:C1:D9:05:03:3D

X509v3 Authority Key Identifier:

keyid:5C:2D:62:32:41:0A:5C:EB:4C:CF:41:A9:FB:81:F9:C1:D9:05:03:3D

X509v3 Basic Constraints: critical

CA:TRUE

Signature Algorithm: sha256WithRSAEncryption

1c:a4:5d:2e:71:2d:3d:74:98:f4:0e:d1:39:7e:ae:bc:cf:fb:

6c:7a:19:e6:f5:1e:57:0a:93:91:03:4f:9d:02:fb:f9:b7:f4:

64:92:a2:aa:33:34:2d:5a:52:bc:7c:b6:b1:a0:59:d3:98:72:

dd:c6:d2:e5:8c:e0:8b:87:60:44:c8:2c:ad:20:3d:9f:83:b1:

53:e7:22:bc:85:64:fe:b3:11:90:fb:68:1f:ba:04:bd:1a:8f:

dd:02:5d:aa:42:9b:9c:7f:5e:95:63:5f:07:65:b9:0d:83:0c:

a4:f6:48:d4:74:fc:bc:93:9f:79:68:9b:30:d8:c0:e4:d2:d7:

42:aa:fb:43:ef:40:4a:17:9d:3a:6f:50:24:c1:52:74:15:07:

50:82:64:60:20:e1:ec:85:72:11:14:4e:bd:44:a2:74:92:db:

30:d2:32:98:a7:f3:c2:47:b4:f5:6c:60:6d:0e:50:87:75:c7:

a3:a4:5d:25:96:58:43:bb:2b:c4:6c:ea:f1:88:f4:b1:29:22:

0b:cd:03:64:b8:fb:65:cf:29:62:59:ec:b8:b8:33:09:58:cf:

f5:67:2e:f4:b4:7d:de:84:e3:05:84:b8:91:2c:a1:32:af:44:

fa:2d:3e:c3:01:72:c9:56:c9:f0:ce:5e:28:61:f1:79:56:68:

36:f3:bb:21