Creating self-signed root and client certificates.

Hi,

A quick guide on how to create selfsigned certificates using openssl:

Setup Ca environment:

vi /etc/pki/tls/openssl.cnf

dir             = /usr/local/lib/CA     # Where everything is kept

cd /usr/local/lib
mkdir CA
mkdir newcerts private
echo '01' > serial
touch index.txt

cd /usr/local/lib/CA

Generate key:

openssl genrsa -des3 -out server.key 1024

Generating RSA private key, 1024 bit long modulus

......................................++++++

................................................++++++

e is 65537 (0x10001)

Enter pass phrase for server.key:

Verifying - Enter pass phrase for server.key:

Generate self signed root certificate:

openssl req -new -x509 -days 3560 -key server.key -out server.crt

Enter pass phrase for server.key:

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:BE

State or Province Name (full name) [Berkshire]:Antwerpen

Locality Name (eg, city) [Newbury]:Berchem

Organization Name (eg, company) [My Company Ltd]:FirstServed NV/SA

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:ca.firstserved.net

Email Address []:nospam@firstserved.net

Create client key:

openssl genrsa -out quorumd.key 1024

Generating RSA private key, 1024 bit long modulus

............++++++

.........................................................++++++

e is 65537 (0x10001)

Create the certificate request for the client:

openssl req -new -days 3560 -key quorumd.key -out quorumd.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:BE

State or Province Name (full name) [Berkshire]:Antwerpen

Locality Name (eg, city) [Newbury]:Berchem

Organization Name (eg, company) [My Company Ltd]:FirstServed NV/SA

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:bemobile

Email Address []:nospam@firstserved.net

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Sign the request using your self-signed certificate:

openssl ca -days 3560 -in quorumd.csr -cert server.crt -keyfile server.key -out quorumd.crt

Using configuration from /etc/pki/tls/openssl.cnf

Enter pass phrase for server.key:

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 1 (0x1)

        Validity

            Not Before: May 22 10:44:49 2008 GMT

            Not After : Feb 19 10:44:49 2018 GMT

        Subject:

            countryName               = BE

            stateOrProvinceName       = Antwerpen

            organizationName          = FirstServed NV/SA

            commonName                = bemobile

            emailAddress              = nospam@firstserved.net

        X509v3 extensions:

            X509v3 Basic Constraints:

                CA:FALSE

            Netscape Comment:

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier:

                29:A5:E4:6A:F4:4E:89:35:5D:7D:C6:9A:CE:B9:D0:1B:75:0A:7F:8C

            X509v3 Authority Key Identifier:

                keyid:4B:B2:BA:F6:65:66:60:EB:CC:45:F5:57:34:FB:E9:AB:40:CF:B4:E8

Certificate is to be certified until Feb 19 10:44:49 2018 GMT (3560 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

That should do it.

Koen