Difference between revisions of "How to create SSL CA Cert Server"
| Line 13: | Line 13: | ||
Now to generate and sign a cert: | Now to generate and sign a cert: | ||
| − | + | 1) Create a Certificate Authority private key (this is your most important key): | |
openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key | openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key | ||
| − | + | 2) Create your CA self-signed certificate: | |
openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem | openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem | ||
| − | + | 3) Issue a client certificate by first generating the key, then request (or use one provided by external system) then sign the certificate using private key of your CA: | |
openssl genrsa -out client.key 1024 | openssl genrsa -out client.key 1024 | ||
openssl req -new -key client.key -out client.csr | openssl req -new -key client.key -out client.csr | ||
Revision as of 22:42, 3 March 2016
OpenSSL needs to have a CA directory created in order to sign crt requests. Use the following steps to create a CA server, then generate/sign keys:
Run the following to create a CA directory:
cd /etc/pki/ mv CA CA.original CA.pl -newca mv demoCA CA
Fix CA issues:
touch /etc/pki/CA/index.txt echo '1000' > /etc/pki/CA/serial
Now to generate and sign a cert:
1) Create a Certificate Authority private key (this is your most important key):
openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key
2) Create your CA self-signed certificate:
openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem
3) Issue a client certificate by first generating the key, then request (or use one provided by external system) then sign the certificate using private key of your CA:
openssl genrsa -out client.key 1024 openssl req -new -key client.key -out client.csr openssl ca -in client.csr -out client.cer
