View source for Create CA with openssl

== Creating a certification authority ==

Certificate Authority - an organization that issues digital certificates

===Creating the directory structure===
 mkdir CA
 cd CA
 mkdir certs crl newcerts private
 chmod 700 private
 touch index.txt
 echo 1000 > serial
 
index.txt, serial - list of the certificates

===Configuration===
 cp /etc/ssl/openssl.cnf ./
 nano openssl.cnf

In openssl.conf, the path to the CA directory must be set in [ CA_default ]
Example: dir=/home/mrezhi/CA
 [ CA_default ]
 dir=/home/mrezhi/CA

 [ usr_cert ]
 # These extensions are added when 'ca' signs a request.
 basicConstraints=CA:FALSE
 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 nsComment = "OpenSSL Generated Certificate"
 subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid,issuer

 [ v3_ca ]
 # Extensions for a typical CA
 subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid:always,issuer
 basicConstraints = CA:true
 keyUsage = cRLSign, keyCertSign
 
 ...
 [ policy_match ]
 countryName             = match
 stateOrProvinceName     = supplied
 organizationName        = supplied
 organizationalUnitName  = optional
 commonName              = supplied
 emailAddress            = optional

===Generating the private key===
 openssl genrsa -aes256 -out private/ca.key.pem 4096

aes256 - encrypts the private key

===Generating the CA certificate===

 openssl req -config openssl.cnf \
  -new -x509 -days 3650 \
  -key private/ca.key.pem \
  -sha256 -extensions v3_ca \
  -out certs/ca.cert.pem

The file is read-only
 chmod 444 certs/ca.cert.pem

==Generating and signing certificates==

===Private key===
 openssl genrsa -out private/student.tugab.bg.key.pem 4096
 chmod 400 student.tugab.bg.key.pem

===Certificate signing request===
 openssl req -config openssl.cnf \
  -sha256 -new -key private/student.tugab.bg.key.pem \
  -out certs/student.tugab.bg.csr.pem


or
 openssl req -newkey rsa:2048 -keyout private/domain1.tugab.key -out certs/domain1.tugab.csr -config ./openssl.cnf


===Signing the certificate signing request===

 openssl ca -config openssl.cnf \
  -keyfile private/ca.key.pem \
  -cert certs/ca.cert.pem \
  -extensions usr_cert -notext -md sha256 \
  -in certs/student.tugab.bg.csr.pem \
  -out certs/student.tugab.bg.cert.pem

==Configuring a web server==

*Import a Linux/Debian virtual machine
*Copy the key pair to the hosting machine (FileZilla can be used)
*Install apache2
 apt-get install apache2
*Enable the ssl module
 a2enmod ssl
*Enable https
** nano /etc/apache2/ports.conf
** cp /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled
** nano /etc/apache2/sites-enabled/default-ssl , set the paths to the certificates

===Browser===

Add the generated root certificate to the built-in certificates.




==Generate Server Certificate Commands==

*Access the server
 ssh hq@ca-in-hq.ef3.local

*Root user and the configuration folder
 su
 cd /root/ca

*Define the FQDN
 FQDN=xxx.ef3.local

*Generate the key. The key has no password. Length 4096 bits.
 openssl genrsa -out private/$FQDN.key.pem 4096
 chmod 400 private/$FQDN.key.pem 

*Generate the request. Leave the default values, except for the FQDN, which is the name the certificate will be issued for. Location is optional...
 openssl req -config openssl.cnf -sha256 -new -key private/$FQDN.key.pem -out csr/$FQDN.csr.pem
 chmod 444 csr/$FQDN.csr.pem 

*Generate the certificate. Valid for 3000 days.
 openssl ca -config openssl.cnf -extensions server_cert -days 3000 -notext -md sha256 -in csr/$FQDN.csr.pem -out certs/$FQDN.cert.pem

*Save the certificate and key in a format convenient for import into Windows
 openssl pkcs12 -export -out $FQDN.pfx   \
           -inkey private/$FQDN.key.pem \
           -in certs/$FQDN.cert.pem

*Copy them so they can be downloaded through an sftp client
 cp /root/ca/certs/$FQDN.cert.pem /home/?? hq or sf
 cp /root/ca/private/$FQDN.key.pem /home/??
 mv $FQDN.pfx /home/??

== Commands ==

*Open a certificate
 openssl x509 -noout -text -in certs/ca.cert.pem

*Verify a certificate
 openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate.cert.pem 

*Create a private key
 openssl genrsa  -out intermediate/private/t19201.ef3.test.key.pem 4096

*Generate a pfx (certificate + password-protected key)
 openssl pkcs12 -export -out t19201.pfx \
  -inkey intermediate/private/t19201.ef3.test.key.pem \
  -in intermediate/certs/t19201.ef3.test.cert.pem


== Revocation List ==

*Generate
 openssl ca -config openssl.cnf  -gencrl -out crl/ca-in-sf.ef3.local.crl.pem


*Verify
 openssl crl -in ca-in-sf.ef3.local.crl.pem -noout -text


Published at http://crl.ef3.local/ca-in-sf.ef3.local.crl.pem

Published at http://crl.ef3.local/ca-in-hq.ef3.local.crl.pem





https://jamielinux.com/articles/2013/08/act-as-your-own-certificate-authority/

https://jamielinux.com/articles/2013/08/generate-certificate-revocation-list-revoke-certificates/

https://jamielinux.com/articles/2013/08/create-an-intermediate-certificate-authority/





openssl genrsa -out privkey.pem 2048


[[Category:Network Security]]
[[Category:Certificate]]