eh. Let me answer that for me.

openssl is nowadays at ~ 3.x.x

Sh1tty encryption, like the one CertTOOL (KM03769268) is not really accepted anymore, so you will have to do some adjustments on openssl.

So.. what you need is legacy as so called "provider"

reinstall your openssl. If you are a windows fella it'll probably end up in Program Files\OpenSSL x64 or something like that. This is the first point that is missleading: please run "openssl version -a" and you'll see lines like

OPENSSLDIR: "C:\Program Files\Common Files\SSL"
ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"
MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"

yes. it doesn't give a sh1t that you installed into "OpenSSL x64" or whatever. So eighter you mingle with environment variables or copy the whole bin and lib directories to the location returned by the above command.

After that it's openssl.cnf time... Where to find it? Ask openSSL! "openssl version -d"

C:\Program Files\OpenSSL-Win64\bin>openssl version -d
OPENSSLDIR: "C:\Program Files\Common Files\SSL"

Now, this is the exact openssl.cnf you need. Add**** (hold ON, do not just simply ADD, read below) the following lines:

[openssl_init]
providers = provider_sect

# List of providers to load
[provider_sect]

[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1

*** : you'll look for every section [] respectively and extend the lines... just avoid duplicates.

Theory is that you set a provider_sect if not set by default. This sectuon has 2 options default and legacy... Also these two have to be separatly activated >> activate = 1.

AND now you can play with the Certificate TOOL. But only after doing this stuff.

Have fun!

öcsi out