Wiki source code of OpenSSL
Last modified by Sebastian Marsching on 2024/08/17 16:53
Show last authors
author | version | line-number | content |
---|---|---|---|
1 | {{toc/}} | ||
2 | |||
3 | # Managing a Public Key Infrastructure (PKI) with OpenSSL | ||
4 | |||
5 | ## Creating the Certificate Authority (CA) | ||
6 | |||
7 | First we create an RSA key and certificate request for the CA: | ||
8 | |||
9 | ```bash | ||
10 | openssl req -out ca.csr -keyout ca.key -newkey rsa:2048 | ||
11 | ``` | ||
12 | |||
13 | In the next step, we self-sign this certificate request in order to create the CA certificate: | ||
14 | |||
15 | ```bash | ||
16 | openssl x509 -in ca.csr -out ca.crt -days 9131 -signkey ca.key -req -extfile ca.cnf -set_serial 0 | ||
17 | ``` | ||
18 | |||
19 | The configuration file `ca.cnf` used in this example has the following content: | ||
20 | |||
21 | basicConstraints=critical,CA:TRUE | ||
22 | |||
23 | ## Creating and Signing a Server Certificate | ||
24 | |||
25 | In order to create the certificate request and RSA key, we use the following command: | ||
26 | |||
27 | ```bash | ||
28 | openssl req -out cert.csr -keyout cert.key -nodes -newkey rsa:2048 -sha256 | ||
29 | ``` | ||
30 | |||
31 | In this example, we do not protect the private key with a password (`-nodes` option). If you do not want to request a SHA2-signed certificate but prefer a traditional (SHA1 signed) certificate instead, remove the `-sha256` option. | ||
32 | |||
33 | The certificate request is signed with the following command: | ||
34 | |||
35 | ```bash | ||
36 | openssl x509 -in cert.csr -out cert.crt -days 731 -req -extfile server.cnf -CA ca.crt -CAkey ca.key -CAserial serial | ||
37 | ``` | ||
38 | |||
39 | For the first certificate being signed, the option `-CAcreateserial` has to be added to the command line, so that OpenSSL creates the files holding the serials. The configuration file `server.cnf` used in this example has the following content: | ||
40 | |||
41 | basicConstraints=critical,CA:FALSE | ||
42 | extendedKeyUsage=serverAuth | ||
43 | nsCertType=server | ||
44 | |||
45 | In order to add subject alternative names to the certificate, the following line can be added to the `server.cnf` file: | ||
46 | |||
47 | subjectAltName=DNS:name1.example.com,DNS:name2.example.com | ||
48 | |||
49 | ## Signing a Client Certificate | ||
50 | |||
51 | The steps are exactly the same as for a server certificate. However, instead of `server.cnf` a different configuration file is used: | ||
52 | |||
53 | basicConstraints=critical,CA:FALSE | ||
54 | extendedKeyUsage=clientAuth | ||
55 | nsCertType=client | ||
56 | |||
57 | ## Using an EC key | ||
58 | |||
59 | In order to generate an eliptic curve key with the `req` command, a suitable parameters file has to be generated first: | ||
60 | |||
61 | ```bash | ||
62 | openssl genpkey -genparam -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec-p-256-params.pem | ||
63 | ``` | ||
64 | |||
65 | Instead of the `P-256` curve, another curve can be chose of course. This parameter file can then be used with the `-newkey` parameter of the `req` command: | ||
66 | |||
67 | ```bash | ||
68 | openssl req -out cert.csr -keyout cert.key -nodes -newkey param:ec-p-256-params.pem -sha256 | ||
69 | ``` | ||
70 | |||
71 | # Importing a Certificate into the Java Keystore | ||
72 | |||
73 | See [[KeyStore|doc:Development.Java.KeyStore.WebHome]]. | ||
74 | |||
75 | ### Creating a PKCS#12 file | ||
76 | |||
77 | The following command can be used to create a PKCS#12 file containing the certificate, its private key and the root-certificate. Such a file can be used to import the certificate in software (e.g. web browser or e-mail client for client certificates): | ||
78 | |||
79 | ```bash | ||
80 | cat ca.crt cert.crt | openssl pkcs12 -inkey cert.key -out cert.p12 -export | ||
81 | ``` |