Creating Certificates - Revision history

Bombe: Add instructions for adding the new root CA certificate.

2012-08-14T08:10:47Z

Add instructions for adding the new root CA certificate.

Bombe: Added command to create new root CA.

2012-08-13T22:41:34Z

Added command to create new root CA.

Bombe: Add options for creating multi-host certificates.

2012-07-16T18:52:09Z

Add options for creating multi-host certificates.

Bombe: Add categories.

2010-08-14T13:51:47Z

Add categories.

Bombe: First version.

2010-08-14T13:46:21Z

First version.

New page

To secure the communication between a server and its clients SSL certificates are used, both for clients and the server. These certificates are usually valid for a certain amount of time only and thus need to be recreated every now and then.

== Create a New Key ==

In order to create a new certificate, a key must be created first.

$ CA.sh -newreq

You have to enter a password for the key that is created. Remember that passphrase, it is necessary later in case you want to remove the passphrase from the key file in order to allow unattended startups for your client services.

The new key is saved as <code>newkey.pem</code> and a request for a certificate signature for that key (<code>newreq.pem</code>) is created.

== Sign the Certificate Signature Request ==

The certificate signature request needs to be processed by the CA so that a certificate signed by the CA is created.

$ CA.sh -sign

You need to enter the passphrase of your CA for this step. After you have confirmed that you really want to sign that certificate, the signed certificate ends up in <code>newcert.pem</code>.

Basically this is all that is required for your services to operate cleanly and securely.

== Remove the Passphrase from the Private Key File ==

In case you want to use the generated private key as part of an unattended startup procedure (e.g. your VPN client at your home machine) you need to remove the passphrase from the private key file.

$ openssl rsa -in newkey.pem -out newkey.np.pem

Enter the passphrase and the private key is stored without a passphrase in <code>newkey.np.pem</code>.

← Older revision		Revision as of 08:10, 14 August 2012
Line 44:		Line 44:

	A new CA will be created, valid for the next 10 years. After this, ''all server and client certificates have to be regenerated!''		A new CA will be created, valid for the next 10 years. After this, ''all server and client certificates have to be regenerated!''
		+
		+	== Import the New Root CA ==
		+
		+	To be able to use the new root CA it needs to be imported using <tt>certutil</tt> (from the <tt>libnss3-tools</tt> package).
		+
		+	$ certutil -d sql:$HOME/.pki/nssdb -A -t 'C,,' -n ''nickname for the CA'' -i cacert.pem
		+
		+	If an existing certificate can not be updated it needs to be deleted beforehand:
		+
		+	$ certutil -d sql:$HOME/.pki/nssdb -D -n ''nickname for the CA''

← Older revision		Revision as of 22:41, 13 August 2012
Line 36:		Line 36:

	Enter the passphrase and the private key is stored without a passphrase in <code>newkey.np.pem</code>.		Enter the passphrase and the private key is stored without a passphrase in <code>newkey.np.pem</code>.
		+
		+	= Create a New Root CA =
		+
		+	Every now and then, a new root CA must be created (because they usually only last that long). This should be executed from the <tt>demoCA</tt> directory.
		+
		+	$ openssl req -config /etc/ssl/openssl.cnf -new -x509 -keyout private/cakey.pem -out cacert.pem -days 3652
		+
		+	A new CA will be created, valid for the next 10 years. After this, ''all server and client certificates have to be regenerated!''

← Older revision		Revision as of 13:51, 14 August 2010
Line 1:		Line 1:
		+	[[Category:Security]]
		+	[[Category:Certificate Authority]]
	To secure the communication between a server and its clients SSL certificates are used, both for clients and the server. These certificates are usually valid for a certain amount of time only and thus need to be recreated every now and then.		To secure the communication between a server and its clients SSL certificates are used, both for clients and the server. These certificates are usually valid for a certain amount of time only and thus need to be recreated every now and then.

@@ Line 12: / Line 12: @@
 The new key is saved as <code>newkey.pem</code> and a request for a certificate signature for that key (<code>newreq.pem</code>) is created.
 == Sign the Certificate Signature Request ==
@@ Line 17: / Line 23: @@
 The certificate signature request needs to be processed by the CA so that a certificate signed by the CA is created.
-  $ CA.sh -sign
+  $ SSLEAY_CONFIG="-extfile newkey.cnf" CA.sh -sign
 You need to enter the passphrase of your CA for this step. After you have confirmed that you really want to sign that certificate, the signed certificate ends up in <code>newcert.pem</code>.