It’s useful for signing certificates for internal use. Here is a quick way for setting up a self-signed CA using the openssl command in Linux.
mkdir ca
cd ca
openssl req -nodes -new -x509 -keyout ca.key -out ca.crt -subj "/C=TW/ST=Taiwan/L=Taipei/O=ccdw.org/OU=sam/CN=sam.ccdw.org/emailAddress=root@sam.ccdw.org"
Server certificate
To create a server certificate signing request along with a new server key:
openssl req -nodes -new -keyout server.key -out server.csr -subj "/C=TW/ST=Taiwan/L=Taipei/O=ccdw.org/OU=server/CN=server.ccdw.org/emailAddress=server@ccdw.org"
To sign the server certificate:
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 3650
The resulting key can certificate of the server can be combine into a PEM file:
cat server.key server.crt > server.pem
Client certificate
To create a client certificate signing request along with a new client key:
openssl req -nodes -new -keyout client.key -out client.csr -subj "/C=TW/ST=Taiwan/L=Taipei/O=ccdw.org/OU=client/CN=Good Client/emailAddress=good@client.ccdw.org"
To sign the client certificate:
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAserial ca.srl -out client.crt -days 1000
The browser usually needs the certificate in PKCS#12 format. To convert the format of the certificate:
openssl pkcs12 -export -out client.pfx -inkey client.key -in client.crt
The .pfx file can then be imported into a browser.
One thought on “Self-signed CA certificate”