Difference between revisions of "Be your own CA"
Melle Visser (talk | contribs) |
Melle Visser (talk | contribs) |
||
| Line 25: | Line 25: | ||
Generate your B3 server certificate. <br> | Generate your B3 server certificate. <br> | ||
'''Note:'''<br> | |||
Fill in your B3 server name when asked the question: Common Name (eg, YOUR name) []:<br> | Fill in your B3 server name when asked the question: Common Name (eg, YOUR name) []:<br> | ||
<pre>openssl req -config openssl.cnf -new -nodes -keyout private/server.key -out server.csr -days | |||
Just hit enter when asked the question: A challenge password []:<br> | |||
otherwise you would be forced to enter the password everytime you start or restart the Apache webserver | |||
<pre>openssl req -config openssl.cnf -new -nodes -keyout private/server.key -out server.csr -days 3650</pre> | |||
The certificate will be valid for about 10 years.<br> | |||
Keep the key safe<br> | Keep the key safe<br> | ||
<pre>chmod 400 private/server.key</pre> | <pre>chmod 400 private/server.key</pre> | ||
== Sign the Certificate Request == | == Sign the Certificate Request == | ||
<pre>openssl ca -config openssl.cnf -policy policy_anything -out certs/server.crt -infiles server.csr | <pre>openssl ca -config openssl.cnf -policy policy_anything -out certs/server.crt -infiles server.csr | ||
Revision as of 13:00, 17 August 2011
Tired of untrusted SSL messages? Then why not be your own Certificate Authority !?
This how-to describes how to generate your own CA certificate and generate and sign your own certificates.
Generate a CA Certificate and Key
Become the root user
su - mkdir -m 0755 CA CA/private CA/certs CA/newcerts CA/crl cd CA cp /etc/ssl/openssl.cnf . chmod 600 index.txt serial openssl.cnf
Modify the following parameters in the just copied file openssl.cnf
default_md = sha256 default_bits = 2048 dir = . # Where everything is kept certificate = $dir/certs/myca.crt # The CA certificate private_key = $dir/private/myca.key # The private key
Generate your CA certificate
openssl req -config openssl.cnf -new -x509 -extensions v3_ca -keyout private/myca.key -out certs/myca.crt -days 7300
Keep your password and key safe!
chmod 400 private/myca.key
Generate a Certificate Request
Generate your B3 server certificate.
Note:
Fill in your B3 server name when asked the question: Common Name (eg, YOUR name) []:
Just hit enter when asked the question: A challenge password []:
otherwise you would be forced to enter the password everytime you start or restart the Apache webserver
openssl req -config openssl.cnf -new -nodes -keyout private/server.key -out server.csr -days 3650
The certificate will be valid for about 10 years.
Keep the key safe
chmod 400 private/server.key
Sign the Certificate Request
openssl ca -config openssl.cnf -policy policy_anything -out certs/server.crt -infiles server.csr rm server.csr
Verify the certificate
openssl x509 -subject -issuer -enddate -noout -in certs/server.crt openssl verify -purpose sslserver -CAfile certs/myca.crt certs/server.crt
Bounce Apache
Replace the old certifcates with your new certificates
cp /etc/apache2/cacert.pem /etc/apache2/cacert.pem.orig cp /etc/apache2/privkey.pem /etc/apache2/privkey.pem.orig cp /root/CA/certs/server.crt /etc/apache2/cacert.pem cp /root/CA/private/server.key /etc/apache2/privkey.pem
Restart the Apache webserver
/etc/init.d/apache2 restart
Import the CA certificate
Import the CA certificate, this is file /root/CA/certs/myca.crt, into the browser of your choice.