simple OpenSSL Certficate Authority
Create Certificate Authority
station7:/etc # station7:/usr/share/ssl/misc # ./CA.sh -newca
CA certificate filename (or enter to create)
Making CA certificate ...
Generating a 1024 bit RSA private key
.....++++++
.....................................++++++
writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:DE
State or Province Name (full name) [Some-State]:BW
Locality Name (eg, city) []:Stuttgart
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Inc.
Organizational Unit Name (eg, section) []:IuK/Netzwerke
Common Name (eg, YOUR name) []:station7.example.com
Email Address []:hostmaster@example.com
station7:/usr/share/ssl/misc #
Create Certificate Request
station7:/usr/share/ssl/misc # openssl req -new -nodes -keyout newreq.pem -out newreq.pem Generating a 1024 bit RSA private key ....++++++ .++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:DE State or Province Name (full name) [Some-State]:BW Locality Name (eg, city) []:Stuttgart Organization Name (eg, company) [Internet Widgits Pty Ltd]:UKBW Stuttgart Organizational Unit Name (eg, section) []:IuK/Netzwerke Common Name (eg, YOUR name) []:station7.example.com Email Address []:hostmaster@example.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: station7:/usr/share/ssl/misc #
Sign Certificate Request
station7:/usr/share/ssl/misc # ./CA.sh -sign
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jun 28 14:41:04 2007 GMT
Not After : Jun 27 14:41:04 2008 GMT
Subject:
countryName = DE
stateOrProvinceName = BW
localityName = Stuttgart
organizationName = Example Inc.
organizationalUnitName = IuK/Netzwerke
commonName = station7.example.com
emailAddress = hostmaster@example.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
1A:DA:45:36:71:DF:E8:62:0D:EB:F9:5F:FE:02:75:E2:6A:D7:AB:0D
X509v3 Authority Key Identifier:
keyid:CC:6C:8E:D5:23:DF:EB:5F:A5:17:99:8D:C2:70:FA:0C:37:81:22:D0
DirName:/C=DE/ST=BW/L=Stuttgart/O=Example Inc./OU=IuK/Netzwerke/CN=station7.example.com/emailAddress=hostmaster@example.com
serial:82:4A:A3:00:03:DC:19:D4
Certificate is to be certified until Jun 27 14:41:04 2008 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: md5WithRSAEncryption
Issuer: C=DE, ST=BW, L=Stuttgart, O=Example Inc., OU=IuK/Netzwerke, CN=station7.example.com/emailAddress=hostmaster@example.com
Validity
Not Before: Jun 28 14:41:04 2007 GMT
Not After : Jun 27 14:41:04 2008 GMT
Subject: C=DE, ST=BW, L=Stuttgart, O=Example Inc., OU=IuK/Netzwerke, CN=station7.example.com/emailAddress=hostmaster@example.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:be:cd:b5:74:24:47:65:f7:73:9a:4d:39:ea:19:
3f:eb:9e:c9:d6:cb:c0:3f:b8:98:c8:5b:30:8f:47:
af:92:d6:df:56:1c:f9:f6:08:02:39:87:b4:4c:53:
a3:2c:ea:70:08:10:32:fb:23:91:5e:4e:5c:6d:21:
7e:06:f8:c9:f6:d3:08:de:b8:e3:89:9d:67:ee:cb:
98:09:cb:73:05:05:19:a7:5d:23:15:d7:b0:93:23:
fc:b0:0b:b4:e3:a4:8c:26:53:94:d4:f4:d1:95:ef:
a2:a1:5d:a6:59:78:2b:1c:2c:46:94:16:92:17:65:
5f:ce:fb:e1:ab:1c:51:ee:dd
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
1A:DA:45:36:71:DF:E8:62:0D:EB:F9:5F:FE:02:75:E2:6A:D7:AB:0D
X509v3 Authority Key Identifier:
keyid:CC:6C:8E:D5:23:DF:EB:5F:A5:17:99:8D:C2:70:FA:0C:37:81:22:D0
DirName:/C=DE/ST=BW/L=Stuttgart/O=Example Inc./OU=IuK/Netzwerke/CN=station7.example.com/emailAddress=hostmaster@example.com
serial:82:4A:A3:00:03:DC:19:D4
Signature Algorithm: md5WithRSAEncryption
9e:b4:ac:e5:94:24:fe:cd:5b:d0:76:d5:6b:2a:96:87:91:58:
45:f8:47:62:c0:93:b4:90:1d:33:0e:f7:cd:d3:a0:a3:2e:2f:
6d:da:a3:e1:8c:2f:45:67:f4:a7:0d:b0:59:ea:59:c0:b2:2b:
54:3f:49:69:8e:35:32:d9:fd:bc:e3:a5:7d:6f:91:16:70:f1:
c9:66:50:e0:bc:30:4d:06:5d:1e:0e:08:ea:04:af:fa:40:b3:
72:9d:2e:23:bb:7f:23:f5:6e:70:8a:d9:10:ff:37:c5:5d:ad:
61:c8:19:c4:9c:39:cf:54:68:0e:44:04:f4:e1:be:5c:eb:02:
d5:45
-----BEGIN CERTIFICATE-----
MIIEAzCCA2ygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBpzELMAkGA1UEBhMCREUx
CzAJBgNVBAgTAkJXMRIwEAYDVQQHEwlTdHV0dGdhcnQxFzAVBgNVBAoTDlVLQlcg
U3R1dHRnYXJ0MRgwFgYDVQQLEw9JdUsgLyBOZXR6d2Vya2UxIDAeBgNVBAMTF2dy
b3Vwd2FyZS10ZXN0LnVrLWJ3LmRlMSIwIAYJKoZIhvcNAQkBFhNob3N0bWFzdGVy
QHVrLWJ3LmRlMB4XDTA3MDYyODE0NDEwNFoXDTA4MDYyNzE0NDEwNFowgacxCzAJ
BgNVBAYTAkRFMQswCQYDVQQIEwJCVzESMBAGA1UEBxMJU3R1dHRnYXJ0MRcwFQYD
VQQKEw5VS0JXIFN0dXR0Z2FydDEYMBYGA1UECxMPSXVLIC8gTmV0endlcmtlMSAw
HgYDVQQDExdncm91cHdhcmUtdGVzdC51ay1idy5kZTEiMCAGCSqGSIb3DQEJARYT
aG9zdG1hc3RlckB1ay1idy5kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
vs21dCRHZfdzmk056hk/657J1svAP7iYyFswj0evktbfVhz59ggCOYe0TFOjLOpw
CBAy+yORXk5cbSF+BvjJ9tMI3rjjiZ1n7suYCctzBQUZp10jFdewkyP8sAu046SM
JlOU1PTRle+ioV2mWXgrHCxGlBaSF2VfzvvhqxxR7t0CAwEAAaOCATswggE3MAkG
A1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRp
ZmljYXRlMB0GA1UdDgQWBBQa2kU2cd/oYg3r+V/+AnXiaterDTCB3AYDVR0jBIHU
MIHRgBTMbI7VI9/rX6UXmY3CcPoMN4Ei0KGBraSBqjCBpzELMAkGA1UEBhMCREUx
CzAJBgNVBAgTAkJXMRIwEAYDVQQHEwlTdHV0dGdhcnQxFzAVBgNVBAoTDlVLQlcg
U3R1dHRnYXJ0MRgwFgYDVQQLEw9JdUsgLyBOZXR6d2Vya2UxIDAeBgNVBAMTF2dy
b3Vwd2FyZS10ZXN0LnVrLWJ3LmRlMSIwIAYJKoZIhvcNAQkBFhNob3N0bWFzdGVy
QHVrLWJ3LmRlggkAgkqjAAPcGdQwDQYJKoZIhvcNAQEEBQADgYEAnrSs5ZQk/s1b
0HbVayqWh5FYRfhHYsCTtJAdMw73zdOgoy4vbdqj4YwvRWf0pw2wWepZwLIrVD9J
aY41Mtn9vOOlfW+RFnDxyWZQ4LwwTQZdHg4I6gSv+kCzcp0uI7t/I/VucIrZEP83
xV2tYcgZxJw5z1RoDkQE9OG+XOsC1UU=
-----END CERTIFICATE-----
Signed certificate is in newcert.pem
station7:/usr/share/ssl/misc #
As result you got:
- A „Certificate Authorithies“ certificate „cacert.pem“
- A certificate for „station7.example.com“ „newcert.pem“
- A private key for „station7.example.com“ „newreq.pem“
← index