I became my own certificate authority  after running through the tutorial at: https://jamielinux.com/docs/openssl-certificate-authority/I created a root pair, created an intermediate pair, and signed a server certificate, which I installed on squid like this:http_port 3129 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid3/certs/gatesentry.csr.cert.pem key=/etc/squid3/key/gatesentry.key.pemin squid3.confSquid starts up just fine with this.  Still not sure if it's actually working or not.When I try to generate a client-side certificate to install in a browser that will be accessing the internet through the proxy I end up with an error:I generate it based on the Sign server and client certificates section that reads Create a certificateIt states that if I'm going to create a client certificate for authentication, I'll need to use the 'usr_crt' extension and so I run:cd /root/caopenssl ca -config intermediate/openssl.conf \      -extensions usr_cert -days 375 -notext -md sha256 \      -in intermediate/csr/gatesentry.csr.pem \      -out intermediate/certs/client.cert.pemUsing configuration from intermediate/openssl.confEnter pass phrase for /root/ca/intermediate/private/intermediate.key.pem:Check that the request matches the signatureSignature okCertificate Details:        Serial Number: 4097 (0x1001)        Validity            Not Before: Jun 22 10:36:44 2016 GMT            Not After : Jul  2 10:36:44 2017 GMT        Subject:            countryName               = US            stateOrProvinceName       = Pennsylvania            localityName              = locality            organizationName          = Parents            organizationalUnitName    = Security            commonName                = gatesentry.domain.lan            emailAddress              = someemail@place.com        X509v3 extensions:            X509v3 Basic Constraints:                 CA:FALSE            Netscape Cert Type:                 SSL Client, S/MIME            Netscape Comment:                 OpenSSL Generated Client Certificate            X509v3 Subject Key Identifier:                 XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX            X509v3 Authority Key Identifier:                 keyid:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX            X509v3 Key Usage: critical                Digital Signature, Non Repudiation, Key Encipherment            X509v3 Extended Key Usage:                 TLS Web Client Authentication, E-mail ProtectionCertificate is to be certified until Jul  2 10:36:44 2017 GMT (375 days)Sign the certificate? [y/n]: yfailed to update databaseTXT_DB error number 2I don't understand why I am getting the TXT_DB error number 2 message when I am running the command as root (on another machine of course).According to the tutorial, I should be able to change the Common Name during this process.
Can't generate client-side certificate after becoming my own Certificate Authority
openssl;squid