# Ruby + openssl + self signed certificates = confusion

**URL:** <https://www.ruby-forum.com/t/ruby-openssl-self-signed-certificates-confusion/102430>\
**Category:** Ruby\
**Created:** [August 15, 2006, 2:17pm UTC](https://www.ruby-forum.com/t/ruby-openssl-self-signed-certificates-confusion/102430 "2006-08-15T14:17:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neumann](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/50afbb/32.png) [@Neumann](https://www.ruby-forum.com/u/Neumann)\
**Post date:** [August 15, 2006, 2:17pm UTC](https://www.ruby-forum.com/t/ruby-openssl-self-signed-certificates-confusion/102430/1 "2006-08-15T14:17:16Z")

</div>

I’m trying to work a bit of CA ability into some code that I’m writing,  
and I need to create a self-signed certificate. This is not going so  
well. I’m able to create the certificate, and it seems to work OK,  
until I save it. The sample code I use to create a test certificate is  
as follows:

entries = {“countryName” =\> “USA”, “stateOrProvinceName” =\> “New  
Mexico”, “localityName” =\> “Albuquerque”, “organizationName” =\> “That  
group of dudes”, “organizationalUnitName” =\> “The cool dudes”,  
“commonName” =\> “William D. Neumann”}  
keypair2048 = PKey::RSA.new(2048) { putc “.” }  
name = X509::Name.new()  
entries.each { |\_k,\_v| name.add\_entry(\_k,\_v) }  
cert = Certificate.new  
cert.public\_key = keypair2048.public\_key  
cert.subject = name  
cert.issuer = name  
cert.version = 2  
now = Time.now.utc  
next\_year = now + (365 \* 24 \* 60 \* 60)  
cert.not\_before = now  
cert.not\_after = next\_year  
ef = ExtensionFactory.new  
bc = ef.create\_extension(“basicConstraints”, “CA:TRUE”)  
ku = ef.create\_extension(“keyUsage”, “keyEncipherment,  
digitalSignature”)  
cert.extensions = [bc, ku]  
cert.sign(keypair2048, Digest::SHA1.new)

Now, when I test the signature on this certificate, all is well:  
irb(main):099:0\> cert.verify cert.public\_key  
=\> true

But if I save the certificate and read it back in, I have no such luck:  
File.open(“newcert.pem”,“w”) do |\_file|  
\_file \<\< cert.to\_pem  
end

newcert = Certificate.new(File.read “newcert.pem”)  
irb(main):105:0\> newcert.verify newcert.public\_key  
=\> false  
irb(main):106:0\> newcert.verify cert.public\_key  
=\> false

But oddly enough, this works.

irb(main):107:0\> cert.verify newcert.public\_key  
=\> true

Also, if I create a different certificate, and sign it using cert’s  
key, I can save it, read it back in and verify it with cert’s public  
key (and newcert’s as well) just fine. Does anyone know what’s going  
on here with the self signed certificate?