blob: 6f052115ccafa2aff20513f0e4e56909fbe7baaa (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
|
How to setup your own Certificate Authority
===========================================
Note: this howto requires the openssl binary, as well as classic
UNIX tools (cat, touch, echo). If you use Windows, please consider
installing Cygwin -- see http://cygwin.com/
1. Configure OpenSSL
--------------------
First of all, create sslconf.txt in the current directory
(a basic example is provided at the end of this file).
cat > sslconf.txt <<"EOF"
[paste contents here]
EOF
Then you need to create the database and a starting serial number:
touch index
echo "01" > serial
mkdir newcerts
2. Generate the CA certificate
------------------------------
openssl req -config sslconf.txt -days 3653 -x509 -newkey rsa:2048 \
-set_serial 0 -text -keyout test-ca.key -out test-ca.crt
3. Generate the private keys and certificate requests
-----------------------------------------------------
openssl genrsa -out server1.key 2048
openssl genrsa -out server2.key 2048
openssl genrsa -out client1.key 2048
openssl genrsa -out client2.key 2048
openssl req -config sslconf.txt -new -key server1.key -out server1.req
openssl req -config sslconf.txt -new -key server2.key -out server2.req
openssl req -config sslconf.txt -new -key client1.key -out client1.req
openssl req -config sslconf.txt -new -key client2.key -out client2.req
4. Issue and sign the certificates
----------------------------------
openssl ca -config sslconf.txt -in server1.req -out server1.crt
openssl ca -config sslconf.txt -in server2.req -out server2.crt
openssl ca -config sslconf.txt -in client1.req -out client1.crt
openssl ca -config sslconf.txt -in client2.req -out client2.crt
5. To revoke a certificate and update the CRL
---------------------------------------------
openssl ca -config sslconf.txt -revoke server1.crt
openssl ca -config sslconf.txt -revoke client1.crt
openssl ca -config sslconf.txt -gencrl -out crl.pem
6. To display a certificate and verify its validity
---------------------------------------------------
openssl x509 -in server2.crt -text -noout
cat test-ca.crt crl.pem > ca_crl.pem
openssl verify -CAfile ca_crl.pem -crl_check server2.crt
rm ca_crl.pem
7. To export a certificate into a .pfx file
-------------------------------------------
openssl pkcs12 -export -in client2.crt -inkey client2.key \
-out client2.pfx
##================================================================
##============== Example OpenSSL configuration file ==============
##================================================================
# References:
#
# /etc/ssl/openssl.conf
# http://www.openssl.org/docs/apps/config.html
# http://www.openssl.org/docs/apps/x509v3_config.html
[ ca ]
default_ca = my_ca
[ my_ca ]
certificate = test-ca.crt
private_key = test-ca.key
database = index
serial = serial
new_certs_dir = newcerts
default_crl_days = 60
default_days = 730
default_md = sha1
policy = my_policy
x509_extensions = v3_usr
[ my_policy ]
countryName = optional
stateOrProvinceName = optional
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
distinguished_name = my_req_dn
x509_extensions = v3_ca
[ my_req_dn ]
countryName = Country Name..............
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name....
localityName = Locality Name.............
0.organizationName = Organization Name.........
organizationalUnitName = Org. Unit Name............
commonName = Common Name (required)....
commonName_max = 64
emailAddress = Email Address.............
emailAddress_max = 64
[ v3_ca ]
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
[ v3_usr ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
|
