How to deal with “RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)” problem

If you see [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) in you apache error.log file means you have created a cert that is intended to be used to sign other certs, but you're using that cert as your SSL cert. So, it depends how you create the SSL cert.

But how can we solve this problem?!

1. Generate private key and certificate signing request

openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
openssl rsa -passin pass:x -in server.pass.key -out server.key
rm server.pass.key
openssl req -new -key server.key -out server.csr

Note: when the openssl req command asks for a “challenge password”, just press return, leaving the password empty.

2. Generate SSL certificate

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

5 thoughts on “How to deal with “RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)” problem”

Leave a Reply

Your email address will not be published. Required fields are marked *