<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi folks, new to gpg and thid forum,</p>
<p><br>
</p>
<p>I have used keys for many years, but not in a mangement role. Now I am installing Yubikey KSM and Validation server. I thought I understood it well enough but apparently that is not true. While working on the validation piece I was requested to convert
my certificate chain into a pem file and place it where all the parts and pieces of yubikey can get to it via the web. My first what??? moment. Like what is the certificate chain? I did some research and even though it is mentioned quite often by others
I have not been able to assert which file that actuall is. Here is what is in my .gnupg directory:<br>
<br>
. gpg.conf .#lk0x23dd010.changed.16771 .note.swp pubring.gpg random_seed S.gpg-agent<br>
.. .#lk0x10c18a0.changed.32015 note private-keys-v1.d pubring.gpg~ secring.gpg trustdb.gpg<br>
<br>
<br>
key was created as such:<br>
<br>
gpg --gen-key<br>
chose: (2) DSA and Elgamal<br>
Key is valid for? (0) 0<br>
input name,email,user-id and passphrase<br>
gpg: key 1234WXYZ marked as ultimately trusted<br>
public and secret key created and signed.<br>
<br>
then it spit out that it was checked the trustdb returned these types:<br>
uid<br>
pub<br>
sub<br>
<br>
I then took those keys and turned them into yubikey format and loaded them into a db. I thought all was said and done (LOL).<br>
<br>
So I think one of those files is my supposed "certificate chain"... not sure. Maybe I have not created the chain?<br>
<br>
When I try to convert a file (pubring, secring, trustdb) they all end with:<br>
<br>
[root@cswks99 .gnupg]# openssl dsa -in ~/.gnupg/trustdb.gpg -outform pem<br>
read DSA key<br>
unable to load Private Key<br>
140528619882384:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: ANY PRIVATE KEY<br>
unable to load Key<br>
[root@cswks99 .gnupg]# openssl dsa -in ~/.gnupg/secring.gpg -outform pem<br>
read DSA key<br>
unable to load Private Key<br>
140648490235792:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: ANY PRIVATE KEY<br>
unable to load Key<br>
<br>
<br>
1) I am not sure that (2) DSA and Elgamal will work with the above command, it seems like two alogrythms and not one (Elgamal is there too). Is that the problem? Or do I need an intermediary format to accomplish this? What the heck am I doing wrong. I do
have two certs on my server as follows:<br>
<br>
/etc/ssl/certs/ca-bundle.trust.crt<br>
/etc/ssl/certs/ca-bundle.crt<br>
<br>
perhaps they are related? I don't remember what step created them. This is all very confusing to me and I need some gental nudges in the right direction. Sorry for being such a newbie and not really getting any of this. Any help is greatly appreciated.</p>
<p><br>
</p>
<p>Regards,</p>
<p>Jen<br>
<br>
</p>
</body>
</html>