陳傑夫 chienfuchen32

How to setup your own CA with OpenSSL

For educational reasons I've decided to create my own CA. Here is what I learned.

Lets get some context first.

What you need:

Download raspbian and install to SD-card. Here is a good guide on how to install the .img file to the card: https://www.andrewmunsell.com/blog/getting-started-raspberry-pi-install-raspbian

Connect ethernet or wifi, then boot the Raspberry Pi and follow configuration options. Make sure you enable the camera option.

When you get to the command-line:

	##TCP FLAGS##

	Unskilled Attackers Pester Real Security Folks
	==============================================
	TCPDUMP FLAGS
	Unskilled = URG = (Not Displayed in Flag Field, Displayed elsewhere)
	Attackers = ACK = (Not Displayed in Flag Field, Displayed elsewhere)
	Pester = PSH = [P] (Push Data)
	Real = RST = [R] (Reset Connection)
	Security = SYN = [S] (Start Connection)

	#!/bin/sh

	# Generate self signed root CA cert
	openssl req -nodes -x509 -newkey rsa:2048 -keyout ca.key -out ca.crt -subj "/C=AU/ST=NSW/L=Sydney/O=MongoDB/OU=root/CN=`hostname -f`/[email protected]"


	# Generate server cert to be signed
	openssl req -nodes -newkey rsa:2048 -keyout server.key -out server.csr -subj "/C=AU/ST=NSW/L=Sydney/O=MongoDB/OU=server/CN=`hostname -f`/[email protected]"

	# Sign the server cert

	//reference: https://askubuntu.com/questions/66000/how-to-merge-partitions

	# fdisk /dev/sda
	...
	Command (m for help): p
	...
	Device Boot Start End Blocks Id System
	/dev/sda1 * 63 8016434 4008186 83 Linux
	/dev/sda2 8016435 1953520064 972751815 83 Linux
	You need to make sure that your new sda1 starts in the same location (here, 63) and ends where sda2 starts (here, 8016434). And double-check that where sda1 ends is immediately before where sda2 starts (here, 8016434 is immediately followed by 8016435) just to be sure.