Creating a Certificate Authority and Certificates with OpenSSL

To start with, you'll need OpenSSL. Compilation and installation follow the usual methods. It's worth while to note that the default installs everything in /usr/local/ssl. No need to change this (unless you want to).

After you have this installed, you may want to edit the OpenSSL configuration file with the information for your site so you have pleasant defaults when creating and signing certificates. You'll find this in /usr/local/ssl/openssl.cnf in the section req_distinguished_name Here you can set the defaults (denoted by the _default appended to the variable name). Any settings that do not have a default, such as localityName can have one set by appending _default. In this case you'd set localityName_default.

Now, we move on to creating a private Certificate Authority (CA). First, some explanation. The CA is used in SSL to verify the authenticity of a given certificate. The CA acts as a trusted third party who has authenticated the user of the signed certificate as being who they say. The certificate is signed by the CA, and if the client trusts the CA, it will trust your certificate. For use within your organization, a private CA will probably serve your needs. However, if you intend use your certificates for a public service, you should probably obtain a certificate from a known CA.

In addition to identification, your certificate is also used for encryption. If you're thinking a certificate sounds similar to a PGP key, you're right. They use many of the same methods. Something else PGP and SSL have in common is the RSA encryption algorithm, which is patented. This patent expires in September of 2000, so after that you'll be free to use tools with the RSA algorithm (like OpenSSL). Until that time, to legally use RSA you need a license. RSA Data Security usually allows non-commercial use of the RSA algorithm for academic purposes.

Creating a private CA

• Go to the OpenSSL bin directory (/usr/local/ssl/misc by default).
• There should be a script called CA.sh (and a CA.pl that does the same stuff). This hides all the gruesome details of how this works. Without the script this is a very annoying process.
• su to root
  • Make sure that the OpenSSL bin directory is in your path.
• ./CA.sh -newca
  • When prompted for CA filename hit return.
  • Answer the rest of the questions intelligently. The common name would be how this certificate might be referred to. For example, the Equifax Secure CA uses the common name of Equifax Secure Certificate Authority.

Creating certificates

• ./CA.sh -newreq
  • This creates an unsigned certificate request.
  • The procedure is the same as creating a private CA except you'll want to use the name of the host that will use the certificate as the common name (host.domain.com). If they don't match, the client will not like it.
  • You probably don't want to use the same passphrase for this as you did with the CA.
• ./CA.sh -sign
  • It will ask for a PEM pass phrase, that's the passphrase you set for the private CA you created.
  • This signs the certificate that you just created with the CA you created just moments before. You can generate multiple certificates. You'll probably need to. For example, mail.foo.com and www.foo.com each need their own certificate.
• The signed certificate is now in the current directory as newcert.pem. If you are going to create more, you should rename this or it will be overwritten be subsequent signatures.

Creating client-side certificates

• openssl pkcs12 -export -in certs.pem -inkey certs.key -out file.p12 -name "Client Certificate"

Back to main page