title: How to generate both server and client certificates under root CA
body: <p>So, I've been trying to set up an SSL connection between a python client and python server in which both have separate certificates to validate each-other, and both certificates are signed by one CA (which also happens to be the root CA). This should make them both valid to each-other, correct?</p>
  
  <p>My methodology thus far has been to create a bash script that does it all:</p>
  
  <ol>
  <li>It generates the private key for the Root CA</li>
  <li>It generates the Root CA cert using the Root CA private key</li>
  <li>It generates the private key for the server</li>
  <li>It generates the CSR for the server</li>
  <li>It generates the server Cert using the server CSR and Root CA cert</li>
  <li>It generates the private key for the client</li>
  <li>It generates the CSR for the client</li>
  <li>It generates the client Cert using the client CSR and Root CA cert</li>
  </ol>
  
  <pre class="lang-sh prettyprint-override"><code>#!/bin/bash
  
  BOLD=$(tput bold)
  CLEAR=$(tput sgr0)
  
  echo -e "${BOLD}Generating RSA AES-256 Private Key for Root Certificate Authority${CLEAR}"
  openssl genrsa -aes256 -out Root.CA.example.llc.key 4096
  
  echo -e "${BOLD}Generating Certificate for Root Certificate Authority${CLEAR}"
  openssl req -x509 -new -nodes -key Root.CA.example.llc.key -sha256 -days 1825 -out Root.CA.example.llc.pem
  
  echo -e "${BOLD}Generating RSA Private Key for Server Certificate${CLEAR}"
  openssl genrsa -out server/example.llc.server.key 4096
  
  echo -e "${BOLD}Generating Certificate Signing Request for Server Certificate${CLEAR}"
  openssl req -new -key server/example.llc.server.key -out server/example.llc.server.csr
  
  echo -e "${BOLD}Generating Certificate for Server Certificate${CLEAR}"
  openssl x509 -req -in server/example.llc.server.csr -CA Root.CA.example.llc.pem -CAkey Root.CA.example.llc.key -CAcreateserial -out server/example.llc.server.crt -days 1825 -sha256 -extfile server/example.llc.server.ext
  
  echo -e "${BOLD}Generating RSA Private Key for Client Certificate${CLEAR}"
  openssl genrsa -out client/example.llc.client.key 4096
  
  echo -e "${BOLD}Generating Certificate Signing Request for Client Certificate${CLEAR}"
  openssl req -new -key client/example.llc.client.key -out client/example.llc.client.csr
  
  echo -e "${BOLD}Generating Certificate for Client Certificate${CLEAR}"
  openssl x509 -req -days 1825 -in client/example.llc.client.csr -CA Root.CA.example.llc.pem -CAkey Root.CA.example.llc.key -set_serial 01 -out client/example.llc.client.crt
  
  echo "Done!"
  </code></pre>
  
  <p>The server loads these credentials:</p>
  
  <pre class="lang-py prettyprint-override"><code>cntx = SSL.Context(...)
  # ...
  cntx.use_privatekey_file('example.llc.server.key')
  cntx.use_certificate_file('example.llc.server.cert')
  cntx.load_verify_locations('../Root.CA.example.llc.pem')
  </code></pre>
  
  <p>The client loads these credentials:</p>
  
  <pre class="lang-py prettyprint-override"><code>cntx = SSL.Context(...)
  # ...
  cntx.use_privatekey_file('example.llc.client.key')
  cntx.use_certificate_file('example.llc.client.cert')
  cntx.load_verify_locations('../Root.CA.example.llc.pem')
  </code></pre>
  
  <p>The server launches like a rocket</p>
  
  <pre class="lang-py prettyprint-override"><code>server = SSL.Connection(cntx, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
  server.bind(('localhost', 44000))
  server.listen(1)
  server.setblocking(1)
  cli, addr = server.accept()
  </code></pre>
  
  <p>and the client attempts to connect with</p>
  
  <pre class="lang-py prettyprint-override"><code>SSL.Connection(cntx, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
  sock.connect(('localhost', 44000))
  </code></pre>
  
  <p>then I get hit with this madness:</p>
  
  <pre class="lang-py prettyprint-override"><code>OpenSSL.SSL.Error: [('SSL routines', 'ssl3_read_bytes', 'tlsv1 alert unknown ca')]
  </code></pre>
  
  <p>At this point, I'm not sure if the client and server certs should be signed by the root CA, if the client cert should be signed by the server cert, or if I'm going insane with all this certificate trust chain SSL/TLS magic wizard voodoo craziness. Please help.</p>