foo.md

Creating root certificate and signing local certificate with it

The commands are taken from here

• Create the root certificate (rootCA.pem) and the key (rootCA.key):

> openssl genrsa -des3 -out rootCA.key 2048
> openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 16384 -out rootCA.pem

• Trust the rootCA.pem on the device which later will act as the client. Keep the rootCA.key private.
• Create a file called server.csr.cnf (or, for automation purposes, find a way in which you can pass these values to the later command directly) with the following content:

[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn

[dn]
C=CH
ST=Zurich
L=Thalwil
O=Spline AG
OU=Home Automation
emailAddress=info@spline.ch
CN = <PUT THE IP ADDRESS OR FQDN OF YOUR DEVICE HERE>

• Create a file called v3.ext with the following content:

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

• IF you want to issue a certificate for an ADDRESS NAME, append the file v3.ext with the following lines:

subjectAltName = @alt_names
[alt_names]
DNS.1 = <YOUR ADDRESS NAME COMES HERE e.g. bananenbrot.com>

• IF however you want to issue the certificate for an IP ADDRESS, append the file v3.ext with the following line:

subjectAltName = IP:<YOUR IP ADDRESS COMES HERE, LEAVE THE "IP:" PREFIX OR BAD THINGS WILL HAPPEN TO YOU>

• Create the certificate key:

openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -config <( cat server.csr.cnf )

• Issue the server certificate:

openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 16384 -sha256 -extfile v3.ext

• Serve the server.key and server.crt on your webserver, trust the rootCA.pem on your client and you'll be good to go

Import a Server key and certificate into a Java Keystore

Answer taken from this thread

• Covert the server.key and server.crt to a server.p12 file

> openssl pkcs12 -export -in server.crt -inkey server.key \
               -out server.p12 -name [<PUT_YOUR_ALIAS_HERE>] \
               -CAfile ca.crt -caname root

• Convert the server.p12 file to a java keystore

keytool -importkeystore \
        -deststorepass [<YOUR_PASSWORD>] -destkeypass [<YOUR_PASSWORD>] -destkeystore server.keystore \
        -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass <PREVIOUSLY_CHOSEN_PASSWORD> \
        -alias [<PREVIOUSLY_CHOSEN_ALIAS>]