Skip to Content

Wiki source code of OpenSSL

Last modified by Sebastian Marsching on 2024/08/17 16:53
Show last authors
1 {{toc/}}
2
3 # Managing a Public Key Infrastructure (PKI) with OpenSSL
4
5 ## Creating the Certificate Authority (CA)
6
7 First we create an RSA key and certificate request for the CA:
8
9 ```bash
10 openssl req -out ca.csr -keyout ca.key -newkey rsa:2048
11 ```
12
13 In the next step, we self-sign this certificate request in order to create the CA certificate:
14
15 ```bash
16 openssl x509 -in ca.csr -out ca.crt -days 9131 -signkey ca.key -req -extfile ca.cnf -set_serial 0
17 ```
18
19 The configuration file `ca.cnf` used in this example has the following content:
20
21 basicConstraints=critical,CA:TRUE
22
23 ## Creating and Signing a Server Certificate
24
25 In order to create the certificate request and RSA key, we use the following command:
26
27 ```bash
28 openssl req -out cert.csr -keyout cert.key -nodes -newkey rsa:2048 -sha256
29 ```
30
31 In this example, we do not protect the private key with a password (`-nodes` option). If you do not want to request a SHA2-signed certificate but prefer a traditional (SHA1 signed) certificate instead, remove the `-sha256` option.
32
33 The certificate request is signed with the following command:
34
35 ```bash
36 openssl x509 -in cert.csr -out cert.crt -days 731 -req -extfile server.cnf -CA ca.crt -CAkey ca.key -CAserial serial
37 ```
38
39 For the first certificate being signed, the option `-CAcreateserial` has to be added to the command line, so that OpenSSL creates the files holding the serials. The configuration file `server.cnf` used in this example has the following content:
40
41 basicConstraints=critical,CA:FALSE
42 extendedKeyUsage=serverAuth
43 nsCertType=server
44
45 In order to add subject alternative names to the certificate, the following line can be added to the `server.cnf` file:
46
47 subjectAltName=DNS:name1.example.com,DNS:name2.example.com
48
49 ## Signing a Client Certificate
50
51 The steps are exactly the same as for a server certificate. However, instead of `server.cnf` a different configuration file is used:
52
53 basicConstraints=critical,CA:FALSE
54 extendedKeyUsage=clientAuth
55 nsCertType=client
56
57 ## Using an EC key
58
59 In order to generate an eliptic curve key with the `req` command, a suitable parameters file has to be generated first:
60
61 ```bash
62 openssl genpkey -genparam -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec-p-256-params.pem
63 ```
64
65 Instead of the `P-256` curve, another curve can be chose of course. This parameter file can then be used with the `-newkey` parameter of the `req` command:
66
67 ```bash
68 openssl req -out cert.csr -keyout cert.key -nodes -newkey param:ec-p-256-params.pem -sha256
69 ```
70
71 # Importing a Certificate into the Java Keystore
72
73 See [[KeyStore|doc:Development.Java.KeyStore.WebHome]].
74
75 ### Creating a PKCS#12 file
76
77 The following command can be used to create a PKCS#12 file containing the certificate, its private key and the root-certificate. Such a file can be used to import the certificate in software (e.g. web browser or e-mail client for client certificates):
78
79 ```bash
80 cat ca.crt cert.crt | openssl pkcs12 -inkey cert.key -out cert.p12 -export
81 ```