Create self-signed SSL Certificate

create.sh

#!/bin/bash

openssl \
req \
-x509 \
-nodes \
-days 365 \
-newkey rsa:2048 \
-keyout $PWD/httpd-selfsigned.key \
-out $PWD/httpd-selfsigned.crt \
-config <(cat openssl.cnf) \
-subj '/C=Example Country/ST=Example State/L=Example City/O=FirstName LastName/OU=/CN=example.dev/[email protected]'

openssl x509 -in httpd-selfsigned.crt -text -noout

# For Chrome on Linux
# https://stackoverflow.com/questions/7580508/getting-chrome-to-accept-self-signed-localhost-certificate
# certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n httpd-selfsigned.crt -i httpd-selfsigned.crt
# certutil -d sql:$HOME/.pki/nssdb -L

openssl.cnf

[ req ]
#default_bits		= 2048
#default_md		= sha256
#default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
#attributes		= req_attributes
req_extensions = v3_req
x509_extensions = v3_ca

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_min			= 2
countryName_max			= 2
stateOrProvinceName		= State or Province Name (full name)
localityName			= Locality Name (eg, city)
0.organizationName		= Organization Name (eg, company)
organizationalUnitName		= Organizational Unit Name (eg, section)
commonName			= Common Name (eg, fully qualified host name)
commonName_max			= 64
emailAddress			= Email Address
emailAddress_max		= 64

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment

[ v3_ca ]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer:always
subjectAltName         = DNS:example.dev,DNS:*.example.dev
issuerAltName          = issuer:copy

Steps

1. Place create.sh to somewhere in your Server and create openssl.cnf in the same directory.
2. Amend the bits saying example/Example in the files.
3. Run create.sh.

If that did not work, you may need to copy /etc/ssl/openssl.cnf in your server and amend it accordingly with Stack Overflow.

How to use it

• create.sh generates httpd-selfsigned.crt and httpd-selfsigned.key so you make your Web Server (Apache, Nginx, Node.js Program etc) refer them. How to refer them should be found via Google.

• Your PC needs to have httpd-selfsigned.crt installed as trusted certificate to see your Web Site mentioned in create.sh and openssl.cnf (as you should have changed it from example.dev).

• If you use Chrome on Linux, certutil command needs to be used to make Chrome refer httpd-selfsigned.crt.

  • If both server and Chrome are in the same machine, you can comment out the lines starting with certutil in create.sh and run create.sh.