Skip to content

Instantly share code, notes, and snippets.

@kamil-michalak

kamil-michalak/self-signed-certificate-with-custom-ca.md

Forked from fntlnz/self-signed-certificate-with-custom-ca.md
Created July 24, 2018 09:24
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save kamil-michalak/ad52d95b3986d4da1c2112504e666ab0 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save kamil-michalak/ad52d95b3986d4da1c2112504e666ab0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @fntlnz fntlnz revised this gist Oct 27, 2017. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions self-signed-certificate-with-custom-ca.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@
    **Attention:** this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

    ```bash
    openssl genrsa -des3 -out rootCA.key 2048
    openssl genrsa -des3 -out rootCA.key 4096
    ```

    If you want a non password protected key just remove the `-des3` option
    @@ -14,7 +14,7 @@ If you want a non password protected key just remove the `-des3` option
    ## Create and self sign the Root Certificate

    ```bash
    openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
    openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt
    ```

    Here we used our root key to create the root certificate that needs to be distributed in all the computers that have to trust us.
    @@ -42,6 +42,6 @@ openssl req -new -key mydomain.com.key -out mydomain.com.csr
    ## Generate the certificate using the `mydomain` csr and key along with the CA Root key

    ```
    openssl x509 -req -in mydomain.com.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out mydomain.com.crt -days 500 -sha256
    openssl x509 -req -in mydomain.com.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out mydomain.com.crt -days 500 -sha256
    ```

  2. @fntlnz fntlnz created this gist Sep 8, 2016.
    47 changes: 47 additions & 0 deletions self-signed-certificate-with-custom-ca.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,47 @@
    # Create Root CA (Done once)

    ## Create Root Key

    **Attention:** this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

    ```bash
    openssl genrsa -des3 -out rootCA.key 2048
    ```

    If you want a non password protected key just remove the `-des3` option


    ## Create and self sign the Root Certificate

    ```bash
    openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
    ```

    Here we used our root key to create the root certificate that needs to be distributed in all the computers that have to trust us.


    # Create a certificate (Done for each server)

    This procedure needs to be followed for each server/appliance that needs a trusted certificate from our CA

    ## Create the certificate key

    ```
    openssl genrsa -out mydomain.com.key 2048
    ```

    ## Create the signing request

    **Important:** Please mind that while creating the signign request is important to specify the `Common Name` providing the IP address or URL for the service, otherwise the certificate
    cannot be verified

    ```
    openssl req -new -key mydomain.com.key -out mydomain.com.csr
    ```

    ## Generate the certificate using the `mydomain` csr and key along with the CA Root key

    ```
    openssl x509 -req -in mydomain.com.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out mydomain.com.crt -days 500 -sha256
    ```