Necesito:

crear un certificado de CAcrear un https_client-certificatefirmar el certificado https_client por la CA

usando la línea de comandos en Linux - openSUSE. Creo el certificado de CA:

 # openssl genrsa -out rootCA.key 2048
Generating RSA private key, 2048 bit long modulus
..........................................................+++
....................+++
e is 65537 (0x10001)
 # openssl req -x509 -new -nodes -key rootCA.key -days 3650 -out rootCA.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AA
State or Province Name (full name) [Some-State]:A
Locality Name (eg, city) []:A
Organization Name (eg, company) [Internet Widgits Pty Ltd]:A
Organizational Unit Name (eg, section) []:A
Common Name (e.g. server FQDN or YOUR name) []:A
Email Address []:A
 #

Funciona bien. Luego creo el https_client-certificate:

 # openssl genrsa -out client1.key 2048
Generating RSA private key, 2048 bit long modulus
............................+++
.............................................+++
e is 65537 (0x10001)
 #
 # openssl req -x509 -new -nodes -key client1.key -days 3650 -out client1.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:BB
State or Province Name (full name) [Some-State]:B
Locality Name (eg, city) []:B
Organization Name (eg, company) [Internet Widgits Pty Ltd]:B
Organizational Unit Name (eg, section) []:B
Common Name (e.g. server FQDN or YOUR name) []:B
Email Address []:B
 #

Funciona bien. Ahora, cuando trato de firmar el https_client-certificate con la CA, aparece un error aquí:

 # openssl ca -in client1.pem -out client11.pem
Using configuration from /etc/ssl/openssl.cnf
Error opening CA private key ./demoCA/private/cakey.pem
139667082016400:error:02001002:system library:fopen:No such file or directory:bss_file.c:404:fopen('./demoCA/private/cakey.pem','re')
139667082016400:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:406:
unable to load CA private key
 #

Ya probé:

utilizando rutas absolutas ("Error al abrir la clave privada de CA" en Windows)

Pero no hay éxito para mí. Leí en alguna parte que los atributos específicos ingresados deben ser los mismos ingresados en la creación de CA, pero al menos al crear certificados en Windows usando XCA-Tool esto no es correcto. Puedo ingresar cosas completamente diferentes, siempre que lo firme con CA puedo usarlo. ¿Alguien me puede ayudar?

Actualizar: Solo uso .key y .pem porque esto funciona para mí en Windows usando XCA-Tool ... Estoy leyendo el libro de cocina de openSSL (https://www.feistyduck.com/library/openssl-cookbook/online/ch-openssl.html) para ver si hice algún error especial. Primer pensamiento,¿tengo que usar .csr para firmar un certificado, o puedo hacerlo también con otro formato?