Skip to content

Instantly share code, notes, and snippets.

@concosminx

concosminx/create_x509_certs.md

Forked from dasniko/create_x509_certs.md
Created June 6, 2022 14:49
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save concosminx/a24e8029c8ccd5970cd8e52e82b20e57 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save concosminx/a24e8029c8ccd5970cd8e52e82b20e57 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @dasniko dasniko revised this gist Jul 21, 2021. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions create_x509_certs.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,7 @@
    # Create X.509 certificates

    (Steps taken from: https://www.baeldung.com/x-509-authentication-in-spring-security)

    All passwords: _changeit_

    ## RootCA
  2. @dasniko dasniko created this gist Jul 21, 2021.
    29 changes: 29 additions & 0 deletions create_x509_certs.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,29 @@
    # Create X.509 certificates

    All passwords: _changeit_

    ## RootCA

    openssl req -x509 -sha256 -days 3650 -newkey rsa:4096 -keyout rootCA.key -out rootCA.crt

    ## Host certificate

    openssl req -new -newkey rsa:4096 -keyout localhost.key -out localhost.csr -nodes

    Sign host csr with rootCA (see below for file `localhost.ext`):

    openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in localhost.csr -out localhost.crt -days 365 -CAcreateserial -extfile localhost.ext

    ---

    ## Client (user) certificate

    openssl req -new -newkey rsa:4096 -nodes -keyout fredFlintstone.key -out fredFlintstone.csr

    Sign client csr with rootCA:

    openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in fredFlintstone.csr -out fredFlintstone.crt -days 365 -CAcreateserial

    Import client key and crt in keystore to create the "certificate" to be used in the browser:

    openssl pkcs12 -export -out fredFlintstone.p12 -name "fredFlintstone" -inkey fredFlintstone.key -in fredFlintstone.crt
    5 changes: 5 additions & 0 deletions localhost.ext
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,5 @@
    authorityKeyIdentifier=keyid,issuer
    basicConstraints=CA:FALSE
    subjectAltName = @alt_names
    [alt_names]
    DNS.1 = localhost