-
Notifications
You must be signed in to change notification settings - Fork 22
/
Copy pathDigital_Certificates_Using_OpenSSL.txt
173 lines (118 loc) · 5.21 KB
/
Digital_Certificates_Using_OpenSSL.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
Generating Digital Certificates using OpenSSL
-----------------------------------------------
> Generating a self-signed certificate
> Generate a private key.
openssl genrsa | openssl pkcs8 -topk8 -nocrypt -out rsa.pri
> Generate self signed certificate
openssl req -x509 -key rsa.pri -sha256 -days 365 -out test.cer
> Viewing a certificate
openssl x509 -in test.cer -noout -text
> Generating RSA private key and certificate all in one go.
openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 365 -out test.cer
> Generating ECDSA private key and a certificate in one go.
> Generate ECDSA private key.
openssl ecparam -name secp384r1 -noout -genkey -out ec.pri
> Generate self-signed certificate.
openssl req -x509 -key ec.pri -days 365 -sha256 -subj '/CN=Test' -out test.cer
> View certificate
openssl x509 -in test.cer -noout -text
> Adding subject to a certificate
openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 365 -out test.cer -subj '/CN=Test'
openssl req -x509 -newkey rsa:2048 -keyout rsa.pri -sha256 -nodes -days 365 -out test.cer -subj '/CN=Test/O=Acme Inc./OU=Cyber Security/C=IN'
openssl req -x509 -newkey rsa:2048 -keyout rsa.pri -sha256 -nodes -days 365 -out test.cer -subj '/CN=Test/O=Acme Inc./OU=Cyber Security/C=IN/[email protected]'
# Adding extensions
https://www.openssl.org/docs/man3.0/man5/x509v3_config.html
> Basic Constraints
openssl req -x509 -newkey rsa:2048 -keyout rsa.pri -sha256 -nodes -days 365 -out test.cer -subj '/CN=Test/O=Acme Inc./OU=Cyber Security/C=IN/ST=UP/[email protected]' -addext "basicConstraints=critical, CA:false, pathlen:1"
> Subject Alternate names
openssl req -x509 -newkey rsa:2048 -keyout rsa.pri -sha256 -nodes -days 365 -out test.cer -subj '/CN=Test/O=Acme Inc./OU=Cyber Security/C=IN/ST=UP/[email protected]' -addext "basicConstraints=critical, CA:false" -addext "subjectAltName = DNS:acme-inc.com,IP:127.0.0.1"
> Key Usages
openssl req -x509 -newkey rsa:2048 -keyout rsa.pri -sha256 -nodes -days 365 -out test.cer -subj '/CN=Test/O=Acme Inc./OU=Cyber Security/C=IN/ST=UP/[email protected]' -addext "keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement,cRLSign"
> Extended KeyUsage
openssl req -x509 -newkey rsa:2048 -keyout rsa.pri -sha256 -nodes -days 365 -out test.cer -subj '/CN=Test/O=Acme Inc./OU=Cyber Security/C=IN/ST=UP/[email protected]' -addext "extendedKeyUsage = codeSigning, serverAuth, clientAuth"
# Using conf file.
# SAMPLE REQUEST FILE.
[req]
distinguished_name = dname
x509_extensions = cert_ext
prompt = no
[ dname ]
commonName = cyberhashira.com
countryName = XY
stateOrProvinceName = Some State
localityName = Some City
organizationName = Cyber Hashira
organizationalUnitName = Cyber Security
emailAddress = [email protected]
[ cert_ext ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation
extendedKeyUsage = codeSigning
crlDistributionPoints=URI:http://myCA/ca.crl
subjectAltName = @sans
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
authorityInfoAccess = OCSP;URI:http://ocsp.myCA/
authorityInfoAccess = caIssuers;URI:http://myCA/ca.cer
certificatePolicies= 1.2.4.5.6.7
[sans]
IP.1 = 127.0.0.1
DNS.1 = blog.cyberhashira.com
DNS.2 = video.cyberhashira.com
> Generating a self-signed certificate.
openssl req -x509 -config my.cnf -nodes -keyout rsa.pri -out test.cer
Signing a certificate requests.
--------------------------------
> Generating CA keys.
[req]
distinguished_name = dname
x509_extensions = cert_ext
prompt = no
[ dname ]
CN = RootCA
C = XY
ST = Some State
L = Some City
O = Cyber Hashira
OU = Cyber Security
emailAddress = [email protected]
[ cert_ext ]
basicConstraints = CA:TRUE, pathlen:0
keyUsage = keyCertSign, cRLSign
subjectKeyIdentifier=hash
openssl req -x509 -config root.cnf -nodes -keyout root.pri -out root.cer
> Generate keys for webserver
[req]
distinguished_name = dname
req_extensions = req_ext
prompt = no
[ dname ]
CN = CyberHashira.com
C = XY
ST = Some State
L = Some City
O = Cyber Hashira
OU = Cyber Security
emailAddress = [email protected]
[ req_ext ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation
extendedKeyUsage = serverAuth, clientAuth
subjectKeyIdentifier=hash
subjectAltName = @sans
certificatePolicies= 1.2.4.5.6.7
authorityInfoAccess = OCSP;URI:http://ocsp.myCA/
authorityInfoAccess = caIssuers;URI:http://myCA/ca.cer
[sans]
DNS.1 = blog.cyberhashira.com
DNS.2 = video.cyberhashira.com
openssl req -new -config cyberHashira.cnf -nodes -keyout cyberHashira.pri -out cyberHashira.csr
> Read certificate signing request.
openssl req -in cyberhashira.csr -noout -text
> Sign certificate request using root ca.
openssl x509 -req -days 730 -in cyberHashira.csr -CA root.cer -CAkey root.pri -CAcreateserial -out cyberHashira.cer
openssl x509 -req -days 730 -in cyberHashira.csr -CA root.cer -CAkey root.pri -CAcreateserial -out cyberHashira.cer -extensions req_ext -extfile cyberHashira.cnf
Links
-----
https://www.openssl.org/docs/man1.1.1/man1/req.html
https://www.openssl.org/docs/man1.1.1/man5/x509v3_config.html