Software - OpenSSL 

Page / - last modified by Sebastian Marsching on 2024/01/09 22:18 

OpenSSL 
last modified by Sebastian Marsching
on 2024/01/09 22:18

Table of Contents
Managing a Public Key Infrastructure (PKI) with OpenSSL
Creating the Certificate Authority (CA)
Creating and Signing a Server Certificate
Signing a Client Certificate
Using an EC key
Importing a Certificate into the Java Keystore
Creating a PKCS#12 file

•	Managing a Public Key Infrastructure (PKI) with OpenSSL
•	Creating the Certificate Authority (CA)
•	Creating and Signing a Server Certificate
•	Signing a Client Certificate
•	Using an EC key
•	Importing a Certificate into the Java Keystore
•	Creating a PKCS#12 file
Managing a Public Key Infrastructure (PKI) with OpenSSL
Creating the Certificate Authority (CA)
First we create an RSA key and certificate request for the CA:
openssl req -out ca.csr -keyout ca.key -newkey rsa:2048
In the next step, we self-sign this certificate request in order to create the CA certificate:
openssl x509 -in ca.csr -out ca.crt -days 9131 -signkey ca.key -req -extfile ca.cnf -set_serial 0
The configuration file ca.cnf used in this example has the following content:
basicConstraints=critical,CA:TRUE
Creating and Signing a Server Certificate
In order to create the certificate request and RSA key, we use the following command:
openssl req -out cert.csr -keyout cert.key -nodes -newkey rsa:2048 -sha256
In this example, we do not protect the private key with a password (-nodes option). If you do not want to request a SHA2-signed certificate but prefer a traditional (SHA1 signed) certificate instead, remove the -sha256 option.
The certificate request is signed with the following command:
openssl x509 -in cert.csr -out cert.crt -days 731 -req -extfile server.cnf -CA ca.crt -CAkey ca.key -CAserial serial
For the first certificate being signed, the option -CAcreateserial has to be added to the command line, so that OpenSSL creates the files holding the serials. The configuration file server.cnf used in this example has the following content:
basicConstraints=critical,CA:FALSE
extendedKeyUsage=serverAuth
nsCertType=server
In order to add subject alternative names to the certificate, the following line can be added to the server.cnf file:
subjectAltName=DNS:name1.example.com,DNS:name2.example.com
Signing a Client Certificate
The steps are exactly the same as for a server certificate. However, instead of server.cnf a different configuration file is used:
basicConstraints=critical,CA:FALSE
extendedKeyUsage=clientAuth
nsCertType=client
Using an EC key
In order to generate an eliptic curve key with the req command, a suitable parameters file has to be generated first:
openssl genpkey -genparam -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec-p-256-params.pem
Instead of the P-256 curve, another curve can be chose of course. This parameter file can then be used with the -newkey parameter of the req command:
openssl req -out cert.csr -keyout cert.key -nodes -newkey params:ec-p-256-params.pem -sha256
Importing a Certificate into the Java Keystore
See KeyStore.
Creating a PKCS#12 file
The following command can be used to create a PKCS#12 file containing the certificate, its private key and the root-certificate. Such a file can be used to import the certificate in software (e.g. web browser or e-mail client for client certificates):
cat ca.crt cert.crt | openssl pkcs12 -inkey cert.key -out cert.p12 -export