2025/09/26 13:24:41 [emerg] 1#1: SSL_CTX_use_certificate("/certs/bundle.pem") failed (SSL: error:0A00018E:SSL routines::ca md too weak)

rt-user@test-x64-deb10:~$ /opt/cprocsp/bin/amd64/csptest -minica -help
/opt/cprocsp/bin/amd64/csptest -minica [<command>] [<options>]
CSPTEST certificate generation
<command>:
  -root             Generate root CA certificate. Default store: uRoot
  -ca               Generate intermediate CA certificate. Default store: uCA
  -leaf             Generate leaf certificate. Default store: uMy
  -crl              Generate CRL. Default store: uCA
  -request          Generate certificate request
  -process          Generate certificate from request
  -help             Print this help
<certificate options>: see request and process options
<request options>:
  -dn <CN=..O=..>   Certificate DName. This option is mandatory
  -provname <name>  [optional] Provider name, e.g.
                   "Crypto-Pro GOST R 34.10-2012 Cryptographic Service Provider"
  -provtype <type>  [optional] Provider type (default: 80)
  -keytype <type>   Key type for creating key and certificate: signature,
                    exchange, both. Default: both
  -length <keylen>  Set key length in bits
  -certusage <OIDs> Specify comma-separated certificate usages
  -certpolicy <OID> Add certificate policy (can be used multiple times)
  -keyusage <num>   Number corresponding to KeyUsage bitmask
  -altname <name>   Add subject alternative name (can be used multiple times)
  -upn <name>       Add User Principal Name (can be used multiple times)
  -ext <file>       Add extension from file in DER format (can be used multiple
                    times)
  -signtool <name>  Add subject sign tool extension
<process options>:
  -nocheck          Do not check request signature
  -certusage <OIDs> Specify comma-separated certificate usages
  -certpolicy <OID> Add certificate policy (can be used multiple times)
  -keyusage <num>   Number corresponding to KeyUsage bitmask
  -cdp <URL>        Add CRL distribution point (can be used multiple times)
  -aia <URL>        Add AIA URL (can be used multiple times)
  -ocsp <URL>       Add OCSP URL (can be used multiple times)
  -altname <name>   Add subject alternative name (can be used multiple times)
  -upn <name>       Add User Principal Name (can be used multiple times)
  -from [-]<days>   Specify "Not before" offset from now. Default: -10 minutes
  -until [-]<days>  Specify "Not after" offset from now. Default: +1.5 years
  -pkupfrom [-]<d>  Specify private key usage "Not before" offset from now
  -pkupuntil [-]<d> Specify private key usage "Not after" offset from now
<CRL options>:
  -rstore u<name>   Specify user certificate store name with certs to revoke
  -rstore m<name>   Specify system certificate store name with certs to revoke
  -cnumber <number> Specify CRL number. Default: 0
  -from [-]<days>   Specify "This update" offset from now. Default: -10 minutes
  -until [-]<days>  Specify "Next update" offset from now. Default: +1 week
<saving options>:
  -container <name> Specify container name. Default: random generated
  -password <PIN>   Specify container PIN. Default: none
  -exportable       Generate exportable key
  -nokeygen         Use existing keys from specified container
  -store u<name>    Specify user certificate store name
  -store m<name>    Specify system certificate store name
<file options>:
  -fcert <file>     Save certificate to file in DER format
  -fcrl <file>      Save CRL to file in DER format
  -frequest <file>  Save request to file in DER format or read request from
                    file in DER format to generate certificate
<issuer options>:
  -issuer <DName>   Specify signer certificate by DName or thumbprint
  -ipassword <PIN>  Specify container PIN. Default: none
  -istore u<name>   Specify user certificate store name. Default: uRoot
  -istore m<name>   Specify system certificate store name
  -ialg <OID>       Specify OID of signature algorithm. Default: determine
                    using key parameters
  -palg <OID>       Specify OID of subject public key algorithm. Can only be
                    used for CALG_RSA_SIGN, CALG_RSA_KEYX key pairs. Possible
                    values: 1.2.840.113549.1.1.1, 1.2.840.113549.1.1.10.
                    Default: determine using key parameters
<general options>:
  -silent           Do not display any user interface

rt-user@test-x64-deb10:~$ /opt/cprocsp/bin/amd64/csptest -minica -root -dn 'CN=MiniCATest' -provtype 24 -container '\\.\HDIMAGE\minica_test' -password '1' -fcert /tmp/t.cer -ialg 1.2.840.113549.1.1.11 -store utest
Requested container has been opened

Output file (/tmp/t.cer) has been saved

Following certificate has been installed in "test" store:
Subject: CN=MiniCATest
Valid  : 21.01.2026 11:05:56 - 15.07.2027 11:15:56 (UTC)
Issuer : CN=MiniCATest

Total: SYS: 0.000 sec USR: 0.150 sec UTC: 0.150 sec
[ErrorCode: 0x00000000]
rt-user@test-x64-deb10:~$ /opt/cprocsp/bin/amd64/certmgr -list -file /tmp/t.cer
Certmgr Ver:5:0.13722 OS:Linux CPU:AMD64 (c) "Crypto-Pro", 2007-2026.
Program for managing certificates, CRLs and stores.
=============================================================================
1-------
Issuer              : CN=MiniCATest
Subject             : CN=MiniCATest
Serial              : 0x4EDDCC68F895093E
SHA1 Thumbprint     : b9970f8764482d562a136dbd2f83748bd5e50a89
SubjectKeyID        : 3019e47073cddf6654e74a01edafb07ba3c5e265
Signature Algorithm : sha256RSA
PublicKey Algorithm : RSA (1024 bits)
Not valid before    : 21/01/2026 11:05:56 UTC
Not valid after     : 15/07/2027 11:15:56 UTC
PrivateKey Link     : No
=============================================================================

[ErrorCode: 0x00000000]