{"id":13,"date":"2007-03-13T23:27:30","date_gmt":"2007-03-13T21:27:30","guid":{"rendered":"https:\/\/www.melen.org\/~jmgm\/wp\/?p=13"},"modified":"2007-03-16T00:14:24","modified_gmt":"2007-03-15T22:14:24","slug":"creating-self-signed-certificates","status":"publish","type":"post","link":"https:\/\/www.melen.org\/u\/jan\/wp\/?p=13","title":{"rendered":"Creating self signed certificates"},"content":{"rendered":"

First create a openssl.cnf:<\/p>\n

\n oid_section = new_oids
\n [ new_oids ]
\n [ req ]
\n default_days = 3650
\n distinguished_name = req_distinguished_name
\n encrypt_key = no
\n string_mask = nombstr
\n x509_extensions = v3_req # Extensions to add to certificate request
\n [ req_distinguished_name ]
\n countryName = Country Name (2 letter code)
\n countryName_default = FI
\n countryName_min = 2
\n countryName_max = 2<\/p>\n

localityName = Locality Name (eg, city)
\n localityName_default = Espoo<\/p>\n

commonName = Common Name (eg, YOUR name)
\n commonName_default = foo.org
\n commonName_max = 64<\/p>\n

emailAddress = Email Address
\n emailAddress_default = root@foo.org
\n emailAddress_max = 40
\n [ v3_req ]
\nsubjectAltName=DNS:*.foo.org,DNS:*.foo.info,DNS:*.foo.eu,DNS:*.foo.fi
\nsubjectKeyIdentifier=hash
\nauthorityKeyIdentifier=keyid,issuer:always
\nbasicConstraints = CA:true\n<\/p><\/blockquote>\n

Create a RSA private key for your server (will be Triple-DES encrypted and PEM formatted):<\/p>\n

$ openssl genrsa -des3 -out server.key 4096<\/p>\n

Please backup this host.key file and the pass-phrase you entered in a secure location. You can see the details of this RSA private key by using the command:
\n$ openssl rsa -noout -text -in server.key<\/p>\n

If necessary, you can also create a decrypted PEM version (not recommended) of this RSA private key with:<\/p>\n

$ openssl rsa -in server.key -out server.key.unsecure<\/p>\n

Create a self-signed Certificate (X509 structure) with the RSA key you just created (output will be PEM formatted):<\/p>\n

$ openssl req -new -x509 -config openssl.cnf -sha1 -days 3650 -key server.key -out server.crt<\/p>\n

This signs the server CSR and results in a server.crt file.
\nYou can see the details of this Certificate using:<\/p>\n

$ openssl x509 -noout -text -in server.crt<\/p>\n

Now you can use these as the certificates and keys for the apache server if you want. If you want to be your own certificate authority (CA) then you have to do some addtional steps. Now let’s rename all the files previously created as ca.[key|key.unsecure|crt]<\/p>\n

$ openssl genrsa -des3 -out server.key 4096<\/p>\n

Please backup this server.key file and the pass-phrase you entered in a secure location. You can see the details of this RSA private key by using the command:<\/p>\n

$ openssl rsa -noout -text -in server.key<\/p>\n

If necessary, you can also create a decrypted PEM version (not recommended) of this RSA private key with:<\/p>\n

$ openssl rsa -in server.key -out server.key.unsecure<\/p>\n

Create a Certificate Signing Request (CSR) with the server RSA private key (output will be PEM formatted):<\/p>\n

$ openssl req -new -config openssl.cnf -key server.key -out server.csr<\/p>\n

Make sure you enter the FQDN (“Fully Qualified Domain Name”) of the server when OpenSSL prompts you for the “CommonName”, i.e. when you generate a CSR for a website which will be later accessed via https:\/\/www.foo.dom\/, enter “www.foo.dom” here. You can see the details of this CSR by using<\/p>\n

$ openssl req -noout -text -in server.csr<\/p>\n

Now finally sign the certificate request with your CA’s private key.
\n$ openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -extfile openssl.cnf -extensions v3_req -set_serial 01 -out server.crt<\/p>\n","protected":false},"excerpt":{"rendered":"

First create a openssl.cnf: oid_section = new_oids [ new_oids ] [ req ] default_days = 3650 distinguished_name = req_distinguished_name encrypt_key = no string_mask = nombstr x509_extensions = v3_req # Extensions to add to certificate request [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = FI countryName_min = 2 countryName_max = 2 localityName […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[2],"tags":[],"_links":{"self":[{"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=\/wp\/v2\/posts\/13"}],"collection":[{"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13"}],"version-history":[{"count":0,"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=\/wp\/v2\/posts\/13\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.melen.org\/u\/jan\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}