View source for Be your own CA

= Be your own Certificate Authority<br> =

This how-to describes to create your own CA certificate and sign your own certificates.<br>

Create the CA Certificate and Key

su -<br>mkdir -m 0755 \<br> CA \<br> CA/private \<br> CA/certs \<br> CA/newcerts \<br> CA/crl<br>cd CA<br>cp /etc/ssl/openssl.cnf .<br>chmod 600 index.txt serial openssl.cnf

Aanpassing in openssl.cnf<br>default_md = sha256<br>default_bits = 2048<br>dir = . # Where everything is kept<br>certificate = $dir/certs/myca.crt # The CA certificate<br>private_key = $dir/private/myca.key # The private key

<br>openssl req -config openssl.cnf -new -x509 -extensions v3_ca -keyout private/myca.key -out certs/myca.crt -days 1825

chmod 400 private/myca.key

Generate a Certificate Request

openssl req -config openssl.cnf -new -nodes -keyout private/server.key -out server.csr -days 365

Fill in server name at Common Name (eg, YOUR name) []:www.onsleven.com

<br>chmod 400 private/server.key

Sign the Certificate Request

openssl ca -config openssl.cnf -policy policy_anything -out certs/server.crt -infiles server.csr

rm server.csr

Verify the certificate

openssl x509 -subject -issuer -enddate -noout -in certs/server.crt<br>openssl verify -purpose sslserver -CAfile certs/myca.crt certs/server.crt

Apache herstarten

cp /etc/apache2/cacert.pem /etc/apache2/cacert.pem.orig<br>cp /etc/apache2/privkey.pem /etc/apache2/privkey.pem.orig

cp /root/CA/certs/server.crt /etc/apache2/cacert.pem<br>cp /root/CA/private/server.key /etc/apache2/privkey.pem

/etc/init.d/apache2 restart

Importeer CA in browser

take /root/CA/certs/myca.crt and import it into your browser.

References

http://www.g-loaded.eu/2005/11/10/be-your-own-ca/<br>http://www.eclectica.ca/howto/ssl-cert-howto.php<br>