Create CA with openssl

From Ilianko

Creating a certification authority

Certificate Authority - an organization that issues digital certificates

Creating the directory structure

mkdir CA
cd CA
mkdir certs crl newcerts private
chmod 700 private
touch index.txt
echo 1000 > serial

index.txt, serial - list of the certificates

Configuration

cp /etc/ssl/openssl.cnf ./
nano openssl.cnf

In openssl.conf, the path to the CA directory must be set in [ CA_default ] Example: dir=/home/mrezhi/CA 

[ CA_default ]
dir=/home/mrezhi/CA

[ usr_cert ]
# These extensions are added when 'ca' signs a request.
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

[ v3_ca ]
# Extensions for a typical CA
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
keyUsage = cRLSign, keyCertSign

...
[ policy_match ]
countryName             = match
stateOrProvinceName     = supplied
organizationName        = supplied
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

Generating the private key

openssl genrsa -aes256 -out private/ca.key.pem 4096

aes256 - encrypts the private key

Generating the CA certificate

openssl req -config openssl.cnf \
 -new -x509 -days 3650 \
 -key private/ca.key.pem \
 -sha256 -extensions v3_ca \
 -out certs/ca.cert.pem

The file is read-only 

chmod 444 certs/ca.cert.pem

Generating and signing certificates

Private key

openssl genrsa -out private/student.tugab.bg.key.pem 4096
chmod 400 student.tugab.bg.key.pem

Certificate signing request

openssl req -config openssl.cnf \
 -sha256 -new -key private/student.tugab.bg.key.pem \
 -out certs/student.tugab.bg.csr.pem


or 

openssl req -newkey rsa:2048 -keyout private/domain1.tugab.key -out certs/domain1.tugab.csr -config ./openssl.cnf


Signing the certificate signing request

openssl ca -config openssl.cnf \
 -keyfile private/ca.key.pem \
 -cert certs/ca.cert.pem \
 -extensions usr_cert -notext -md sha256 \
 -in certs/student.tugab.bg.csr.pem \
 -out certs/student.tugab.bg.cert.pem

Configuring a web server

  • Import a Linux/Debian virtual machine
  • Copy the key pair to the hosting machine (FileZilla can be used)
  • Install apache2
apt-get install apache2
  • Enable the ssl module
a2enmod ssl
  • Enable https
    • nano /etc/apache2/ports.conf
    • cp /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled
    • nano /etc/apache2/sites-enabled/default-ssl , set the paths to the certificates

Browser

Add the generated root certificate to the built-in certificates.



Generate Server Certificate Commands

  • Access the server
ssh hq@ca-in-hq.ef3.local
  • Root user and the configuration folder
su
cd /root/ca
  • Define the FQDN
FQDN=xxx.ef3.local
  • Generate the key. The key has no password. Length 4096 bits.
openssl genrsa -out private/$FQDN.key.pem 4096
chmod 400 private/$FQDN.key.pem
  • Generate the request. Leave the default values, except for the FQDN, which is the name the certificate will be issued for. Location is optional...
openssl req -config openssl.cnf -sha256 -new -key private/$FQDN.key.pem -out csr/$FQDN.csr.pem
chmod 444 csr/$FQDN.csr.pem
  • Generate the certificate. Valid for 3000 days.
openssl ca -config openssl.cnf -extensions server_cert -days 3000 -notext -md sha256 -in csr/$FQDN.csr.pem -out certs/$FQDN.cert.pem
  • Save the certificate and key in a format convenient for import into Windows
openssl pkcs12 -export -out $FQDN.pfx   \
          -inkey private/$FQDN.key.pem \
          -in certs/$FQDN.cert.pem
  • Copy them so they can be downloaded through an sftp client
cp /root/ca/certs/$FQDN.cert.pem /home/?? hq or sf
cp /root/ca/private/$FQDN.key.pem /home/??
mv $FQDN.pfx /home/??

Commands

  • Open a certificate
openssl x509 -noout -text -in certs/ca.cert.pem
  • Verify a certificate
openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate.cert.pem
  • Create a private key
openssl genrsa  -out intermediate/private/t19201.ef3.test.key.pem 4096
  • Generate a pfx (certificate + password-protected key)
openssl pkcs12 -export -out t19201.pfx \
 -inkey intermediate/private/t19201.ef3.test.key.pem \
 -in intermediate/certs/t19201.ef3.test.cert.pem


Revocation List

  • Generate
openssl ca -config openssl.cnf  -gencrl -out crl/ca-in-sf.ef3.local.crl.pem


  • Verify
openssl crl -in ca-in-sf.ef3.local.crl.pem -noout -text


Published at http://crl.ef3.local/ca-in-sf.ef3.local.crl.pem

Published at http://crl.ef3.local/ca-in-hq.ef3.local.crl.pem



https://jamielinux.com/articles/2013/08/act-as-your-own-certificate-authority/

https://jamielinux.com/articles/2013/08/generate-certificate-revocation-list-revoke-certificates/

https://jamielinux.com/articles/2013/08/create-an-intermediate-certificate-authority/



openssl genrsa -out privkey.pem 2048

Retrieved from "https://ilianko.com/index.php?title=Create_CA_with_openssl&oldid=6272"