Skip to content

Instantly share code, notes, and snippets.

@voltrevo

voltrevo/how-to-ca.md

Last active June 3, 2018 07:31
Show Gist options
  • Save voltrevo/bf0c42b9421743b42781f6ee5f4d14e7 to your computer and use it in GitHub Desktop.
Save voltrevo/bf0c42b9421743b42781f6ee5f4d14e7 to your computer and use it in GitHub Desktop.
Download ZIP
How to run your own Certificate Authority
Raw
how-to-ca.md

How to run your own Certificate Authority

Concepts

  • tls
  • x509
  • https

CA first time set up

  1. Create CA key
openssl genrsa -des3 -out demo-authority.key 2048
  1. Create CA certificate by self-signing CA key
openssl req -x509 -new -nodes -key demo-authority.key -sha256 -days 1825 -out demo-authority.crt
  1. Trust CA certificate (system / browser)

Varies by operating system. Also some applications have their own way of trusting certificates and don't merely trust certificates trusted by the operating system. E.g. Firefox, npm.

Create and sign server certificate

  1. Create server key
openssl genrsa -out demo-server.key 2048
  1. Create CSR - Certificate Signing Request
openssl req -new -key demo-server.key -out demo-server.csr

Also create demo-server.ext with this content:

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
  1. Send CSR to CA
cp demo-server.csr demo-server.ext ../demo-authority/.
  1. Sign certificate
openssl x509 -req -in demo-server.csr -CA demo-authority.crt -CAkey demo-authority.key -CAcreateserial -out demo-server.crt -days 1825 -sha256 -extfile demo-server.ext
  1. Send back to server
cp demo-server.crt ../demo-server/.

References / Further Reading

I created this summary guide for presentation purposes from the following more detailed guides:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment