title: (SSL) Root CA and Client Cert on same machine?
body: <p>I'm trying to communicate with some software at my company (that I did not write). We are able to set the server certificate, server key, and server CA certificate through configuration.</p>
  
  <p>I generate the root certificate on the primary machine with:</p>
  
  <pre><code>openssl genrsa -out rootCA.key 2048
  </code></pre>
  
  <p>I self-sign the root certificate with:</p>
  
  <pre><code>openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
  </code></pre>
  
  <p>I generate the client key the same as I do the root key, generate a CSR with:</p>
  
  <pre><code>openssl req -new -key device.key -out device.csr
  </code></pre>
  
  <p>I then sign the client key with the root certificate with:</p>
  
  <pre><code>openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days 500 -sha256
  </code></pre>
  
  <p>I'm communicating from Python OpenSSL to this application (running in Java). I set the key and certificate files in OpenSSL to the device keys, then set server-ca-cert and server-cert to the root certificate, and server-key to the root key. No matter what, I always get this error in Python:</p>
  
  <pre><code>OpenSSL.SSL.Error: [('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')]
  </code></pre>
  
  <p>And this error in Java:</p>
  
  <pre><code>On handshake complete OpenSSL error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
  </code></pre>
  
  <p>I don't know if I'm doing something wrong, or if it's something with the software I'm not getting - and before I go bugging the CTO I'd like to know if I don't understand SSL/TLS. Am I missing some step? Should a server not use the root certificate as it's own certificate?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>To explain the setup more:</p>
  
  <p>We typically deploy in a clustered environment. </p>
  
  <p>The client application is running on two machines in a master/standby configuration, and the servers are all the machines in the cluster (including the two that are the master/standby network integration units). As part of our installation process, the master machine distributes root SSH keys to all machines in the cluster - so, through Ansible, I have full control over all of the machines. The two NIUs have an application that uses SOAP over TLS to control the software on all the machines in the cluster. We've historically used UDP, but we're making efforts to increase security.</p>