Dear Maintainer, xca stopped being able to sign certificaet requests. Everything appears to work, but the final certificate is unusable. The following error occurs trying to use it. openssl x509 -in hostname.der -noout -text Could not read certificate from hostname.der 4037E3C3767F0000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:../crypto/store/store_result.c:151: Unable to load certificate The .csr file was fine and after spending some hours spinning wheels I was able to generate the .cer file with oopenssl x509 -req. So, something is directly wrong with xca; not with the underlying.
Do you have a minimum preproducible example that we can use to attempt to diagnose this? Including details on general things about your CA certificate, the CSR, what kind of certificate options you set when you tried to generate the certificate, etc. Note that 2.4.0 was released back in 2021, and `oldstable` is a "best effort" scenario for updating. Additionally, I do not believe this qualifies for "grave" severity because we are missing MREs, etc. necessary to really determine what's going on with your environment vs. others' environments. Thomas
I loaded up an oldstable bookworm system, and used XCA's internal templates to create a CA certificate. From that, I was able to use Debian Bookworm's own OpenSSL version to generate a CSR, which I imported into XCA without issue. I was then able to use XCA to sign the CSR and generate a certificate (using SSL server template in XCA again to make sure proper items are set on teh certificate for extensions), and then after exporting that certificate, OpenSSL was able to properly read the certificate without issues. Your issue is not able to be reproduced in XCA, so we need a lot more information about your environment, XCA settings, CA cert settings, key algos, etc. to have a minimum reproducible example. Thomas
On that report, we may remove the "grave"; I'm not sure what went wrong on my machine, nor any way to get at it. My reproduction is trivial: import, sign, export, open .der file and it's broken, and it's an all-defaults install. I'm going to send some samples privately because I don't want google to index them.
I received your samples (and reproduced your CA with test keys locally thanks to your samples provided), but even with them I cannot reproduce on a Debian 12.12 fresh installation with XCA even with your reproduction instructions. (I sent you a separate email independently by the way) Thomas
It's not a *fresh* install. It broke less than three months ago taking security updates.
Upgrade everything fixed the problem. Therefore I'm willing to conclude it was caused by mismatched binaries somewhere, and this bug can be closed out.