Q: Cent OS genkey bad certificate request error -8016 I'm trying to generate a key using the genkey command in centos 6.4.  Every thing seems to go fine but I get this error message bad certificate request error -8016 and no key/cert is generated.

A: This looks like it's a bug reported here in the RHEL/CentOS 6.4 crypto-utils. It's also been reported on the CentOS forums. 

Description of problem:
  Since EL 6.4, a new version of NSS considers MD5 signatures as invalid. 1
  keyutils generated ssl certificates with md5 signatures.
  Since EL 6.4 trying to generate a ssl self-signed certificate leads to segfault.

Possible workaround - from the bug report - generate the files manually
Manual creation works (creates an sha1 signed certificate):
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 1095 -key ca.key -out ca.crt  -subj "/CN=ca.puzzle.ch /O=Puzzle ITC/L=Bern/ST=Bern/C=CH"
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -subj "/CN=server.example.com/O=Puzzle ITC/L=Bern/ST=Bern/C=CH" 
openssl x509 -req -days 1095 -CA ca.crt -CAkey ca.key -set_serial 01 -in server.csr -out server.crt 
openssl x509 -in server.crt -text

Signature Algorithm: sha1WithRSAEncryption


A: Firstly you must be root to generate a key. Probably the problem is that you have not removed the fake key and certificate which were generated during the installation. To fix it you should firstly move to the /etc/httpd/conf directory. Then remove the fake key and certificate by running as root
rm ssl.key/server.keyrm ssl.crt/server.crt

After these steps you can use genkey to generate necessary keys. For instance, if you want to generate a key for example.com you should run this command in your terminal
genkey www.example.com

For further information you can look here (http://www.centos.org/docs/5/html/5.1/Deployment_Guide/s2-secureserver-generatingkey.html).

A: As a workaround, support for MD5 signatures can be manually enabled by setting the environment variable NSS_HASH_ALG_SUPPORT=+MD5, though it's discouraged.

Certificate signatures that make use of the MD5 hash algorithm will now be rejected by default. Support for MD5 may be manually enabled (but is discouraged) by setting the environment variable of "NSS_HASH_ALG_SUPPORT=+MD5" or by using the NSS_SetAlgorithmPolicy function. Note that SSL cipher suites with "MD5" in their names are NOT disabled by this change; those cipher suites use HMAC-MD5, not plain MD5, and are still considered safe.

NSS 3.14 release notes
