Create a Self Signed Certificate on your Mac

macOS-SSL-creation.md

Create a Self Signed Certificate on your Mac

This is simply a simplified version of the following tutorial.

Creating Certificate Authority

Follow the wizard with a few exceptions. Parts that are important to change or important to leave as is are in bold:

• Choose to Override Details,
• Disable extended key usage

Walk-through

• Start Keychain Access.app.
• Select Keychain Access -> Certificate Assistant -> Create Certificate Authority

Create Your Certificate Authority

• Name: Choose a friendly name for your CA
• Identity type: select Self Signed Root CA
• User certificate: Does not matter, we’ll delete it later. SSL Server for now.
• Let me Override Defaults: Check. Very important, you’ll see later why.
• Email from: Select email

Certificate Information

• Serial Number: Choose any number you like. I left it at 1.
• Validity Period (days): No longer than 825 days
• Create a CA web site: Unchecked.
• Sign your invitation: Uncheck

Press Continue

• Email address: Up to you
• Name (Common Name): Select something telling, such as "My Home CA"
• Organization, Unit, City, State, Country: Optional

Key Pair Information for This

• Specify Key Pair Information For Users of This CA: 2048/RSA or longer

Press Continue

Key Usage

• Include Key Usage Extensions: Checked
• Capabilities:
  • Signature: Checked
  • Certificate Signing: Checked

Press Continue

Extended Key Usage

• Extension is Critical: Checked
• SSL Server Authentication: Checked

Basic Constraints

Leave the defaults

Subject Alternate Name

• Include Subject ALternate Name Extension: Checked
  • This extension is critical: Unchecked
  • Extension Values:
    • rfc822Name: Empty
    • URI: Empty
    • DNSName: Specify space-separated list of hostnames: localtestserver localtestserver.local localtestserver.example.com
    • IPAddress: 127.0.0.1

Specify the keychain

Does not really matter. Complete the wizard.

Create the certificate

Trust the certificate

Our certificate was created but it's not yet trusted. In order to trust it, follow these steps:

• open the Keychain Access > Certificates.
• Double click on your certificate
• Unfold Trust and select Always Trust everywhere.

Testing the certificate in a local webserver

Export keys

Open Keychain Access again, search for newly created certificate. You will see three entries: Certificate, Public key and Private key.

• Select Certificate and export it to certificate.cer file.
• Select Private Key and export it to certificate.p12 file, with some pass-phrase.

Convert to plain-text

openssl x509 -inform der -in certificate.cer -out server.crt
openssl pkcs12 -in certificate.p12 -out server.key -nodes

Define your hosts

At the end of the file /etc/hosts, add your domain names listed in the certificate.

127.0.0.1    localtestserver.local
# Do the same for all domains listed in the certificate

NGINX example

Now you can use your certificates in nginx

server {
        listen 443 ssl;
        server_name localtestserver.local;

        location / {
                proxy_pass http://localhost:3000;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_set_header Host $host;
                proxy_cache_bypass $http_upgrade;
        }

        ssl_certificate /path-to-my-certificate/server.crt;
        ssl_certificate_key /path-to-my-certificate/server.key;
        ssl_session_timeout 10m;
        keepalive_timeout 70;
}