Openssl is a cryptographic library that can be used to generate digital certificates. In this blog, I will walk you through the process of creating a Root CA and signing the generated digital certificates with them.
For a quick primer on digital certificates take a look at this article.
To begin with lets generate a Root CA. This process will require generating a CA private key and a CA certificate.
At the point, the Root CA certificate is generated and is ready to be used. We will proceed next to generate the server's Public & Private keys and sign them with the Root CA certificate.
For a quick primer on digital certificates take a look at this article.
To begin with lets generate a Root CA. This process will require generating a CA private key and a CA certificate.
Generate a 4096 bit long RSA key for Root CA
$ openssl genrsa -out rootCA.key 4096 Generating RSA private key, 4096 bit long modulus .........++ .............................++ e is 65537 (0x010001)
Generate Root CA certificate
$ openssl req -x509 -new -key rootCA.key -sha256 -days 1825 -out rootCA.crt You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:IN State or Province Name (full name) [Some-State]:Karnataka Locality Name (eg, city) []:Bangalore Organization Name (eg, company) [Internet Widgits Pty Ltd]:Sarath Systems Private Ltd Organizational Unit Name (eg, section) []:Research & Development Common Name (e.g. server FQDN or YOUR name) []:Sarath Systems Digital Certification Authority Email Address []:xxxxxxxx@gmail.com-days 1825 : Certificate is valid for 5 years
Alternatively, you can use the following syntax for scripting:
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1825 -subj "/C=IN/ST=Karnataka/L=Bangalore/O=Sarath Systems/OU=Research & Development/emailAddress=xxxxxxxx@gmail.com/CN=Sarath Systems Digital Certification Authority" -out rootCA.crt
At the point, the Root CA certificate is generated and is ready to be used. We will proceed next to generate the server's Public & Private keys and sign them with the Root CA certificate.
Generate a 4096 bit long RSA based Server Private Key
$ openssl genrsa -out server.key 4096 Generating RSA private key, 4096 bit long modulus ..................................................................................................................................++ ......................................++ e is 65537 (0x010001)
Generate a CSR (Certificate Signing Request) which is then sent to the CA to be signed by the RootCA.
$ openssl req -new -key server.key -out server.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:IN State or Province Name (full name) [Some-State]:Karnataka Locality Name (eg, city) []:Bangalore Organization Name (eg, company) [Internet Widgits Pty Ltd]:Sarath Systems Organizational Unit Name (eg, section) []:Cloud Security Business Unit Common Name (e.g. server FQDN or YOUR name) []:Cloud Security Email Address []:xxxx@sarathsystems.com
Alternatively you can use the following syntax for scripting
openssl req -new -key server.key -subj "/C=IN/ST=Karnataka/L=Bangalore/O=Sarath Systems/OU=Research & Development/emailAddress=xxxxxxxx@in.ibm.com/OU=Cloud Security Business Unit/CN=Cloud Security" -out server.csr
Generate a signed Server Public Certificate using the CSR and the RootCA
Before we can do this we need to understand a few changes to certificates that happened recently. As of 2000, support for CommonName in the certificates has been dropped and Subject Alternate Name (SAN) has become standardized. The latest versions of Firefox/Chrome look at the SAN field to validate a certificate.
In order to generate a certificate with SAN, we can supply the necessary parameters via a config file. In our case, lets create a file called cert.config with the following data:
In order to generate a certificate with SAN, we can supply the necessary parameters via a config file. In our case, lets create a file called cert.config with the following data:
authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = www.mywebsite.com DNS.2 = www.mywebsite-alternate-dns.com IP.1 = 192.168.56.101 -- An ip address you want to bind the certificate to [optional]
Now generate the Server's Public Key
$ openssl x509 -req -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server.crt -days 1825 -sha2 56 -extfile cert.config Signature ok subject=C = IN, ST = Karnataka, L = Bangalore, O = Sarath Systems Private Ltd, OU = Cloud Security Business Unit, CN = Cloud Security, emailAddress = xxxxxx@sarathsystems.com Getting CA Private Key
Try it out
If you have docker on your system, you can try out a demo container I have written to demonstrate the root CA generation and Server certificate signing by following the instructions @ https://hub.docker.com/r/sarathmekala/pkcsdemo
Comments