How to create a certificate for server?

[406345]

According to another discussion, I have tried this on Ubuntu with openSSL
(1)openssl genrsa -out rootCA.key 2048
(2)openssl req -x509 -new -nodes -key rootCA.key -days 5000 -out rootCA.pem
(3)openssl genrsa -out device.key 2048
(4)openssl req -new -key device.key -out device.csr
(5)openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days 5000

and set "Common Name" to quic.
Then I take device.crt and device.key using on Windows. MsQUIC failed on ConfigurationLoadCredential error code: 0x80070057. So how can I generate a correct certificate? Is there any way to use standalone certificate without add it to "Trush Root"?

[406345]

According to another discussion, I have tried this on Ubuntu with openSSL (1)openssl genrsa -out rootCA.key 2048 (2)openssl req -x509 -new -nodes -key rootCA.key -days 5000 -out rootCA.pem (3)openssl genrsa -out device.key 2048 (4)openssl req -new -key device.key -out device.csr (5)openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days 5000

and set "Common Name" to quic. Then I take device.crt and device.key using on Windows. MsQUIC failed on ConfigurationLoadCredential error code: 0x80070057. So how can I generate a correct certificate? Is there any way to use standalone certificate without add it to "Trush Root"?

I request a certificate from let'sencrypt. It is still error(0x80070057l)........Here is the code:
QUIC_CREDENTIAL_CONFIG CredConfig; CredConfig.Type = QUIC_CREDENTIAL_TYPE_CERTIFICATE_FILE; CredConfig.Flags = QUIC_CREDENTIAL_FLAG_NONE | QUIC_CREDENTIAL_FLAG_NO_CERTIFICATE_VALIDATION; QUIC_CERTIFICATE_FILE certificate = { 0 }; certificate.CertificateFile = (char*)certFile; certificate.PrivateKeyFile = (char*)keyFile; CredConfig.CertificateFile = &certificate;

[406345]

Solved~~~my mistake...I did not initialize QUIC_CREDENTIAL_CONFIG and maybe some fields are invalid value.

self-signed certificate can generate by:

openssl genrsa -out ca.key 2048 openssl req -new -key ca.key -out ca.csr openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt

[nibanks]

Glad you figured it out! Yeah, you must fully initialize the struct, zeroing out things you don't need/use.