OpenSSL - Revision history

William: Add CASetserial for real-world use

2025-02-11T15:14:28Z

Add CASetserial for real-world use

← Older revision		Revision as of 15:14, 11 February 2025
Line 122:		Line 122:
	subject=C = GB, ST = Yorkshire, L = Leeds, O = Company Name, CN = www.mydomain.com		subject=C = GB, ST = Yorkshire, L = Leeds, O = Company Name, CN = www.mydomain.com
	Enter pass phrase for private/intermediate.key:</pre>		Enter pass phrase for private/intermediate.key:</pre>
			For later certificates use the -CAcreateserial switch instead to increment the serial number:
			<pre>$ openssl x509 -req -days 397 -in csr/www.mydomain.com.csr -CA certs/intermediate.crt -CAkey private/intermediate.key -extensions v3_req -extfile extensions.cnf -CAcreateserial -out newcerts/www.mydomain.com.crt</pre>
	Now you have created the certificate, check all the details are correct:		Now you have created the certificate, check all the details are correct:
	<pre>		<pre>

2024-08-07T20:05:36Z

Added signing a CSR

@@ Line 98: / Line 98: @@
 The file <i>www.mydomain.com.csr</i> can be provided to the certificate authority for signing.
 == Writing random seed with writerand ==
 Sometimes openssl lacks a random seed and fails. You can easily create a file for this.
 <pre>$ openssl rand -writerand $HOME/.rnd</pre>

2022-12-29T15:47:05Z

Protected "OpenSSL" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

← Older revision

Revision as of 15:47, 29 December 2022

2022-09-26T08:31:20Z

Specifically say where subjectAltName goes

← Older revision		Revision as of 08:31, 26 September 2022
Line 89:		Line 89:
	# Make a local copy of openssl.cnf		# Make a local copy of openssl.cnf
	# Uncomment the line about v3_extensions<pre>req_extensions = v3_req</pre>		# Uncomment the line about v3_extensions<pre>req_extensions = v3_req</pre>
	# Add a subjectAltName under basicConstraints and keyUsage		# Add a subjectAltName under basicConstraints and keyUsage in <i>[ v3_req ]</i> section.
	<pre>basicConstraints = CA:FALSE		<pre>[ v3_req ]
			basicConstraints = CA:FALSE
	keyUsage = nonRepudiation, digitalSignature, keyEncipherment		keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	subjectAltName = DNS:www.mydomain.com,DNS:mydomain.com,DNS:other.mydomain.com</pre>		subjectAltName = DNS:www.mydomain.com,DNS:mydomain.com,DNS:other.mydomain.com</pre>

2022-09-21T19:24:24Z

Formatting fix

← Older revision		Revision as of 19:24, 21 September 2022
Line 46:		Line 46:
	........................................................................................+++++		........................................................................................+++++
	........+++++		........+++++
			</pre>
	Then create the Certificate Request using the new key		Then create the Certificate Request using the new key

2022-09-21T14:03:56Z

writerand

← Older revision		Revision as of 14:03, 21 September 2022
Line 97:		Line 97:

	The file <i>www.mydomain.com.csr</i> can be provided to the certificate authority for signing.		The file <i>www.mydomain.com.csr</i> can be provided to the certificate authority for signing.
			== Writing random seed with writerand ==
			Sometimes openssl lacks a random seed and fails. You can easily create a file for this.
			<pre>$ openssl rand -writerand $HOME/.rnd</pre>

2022-09-21T13:56:42Z

typo

← Older revision		Revision as of 13:56, 21 September 2022
Line 94:		Line 94:
	subjectAltName = DNS:www.mydomain.com,DNS:mydomain.com,DNS:other.mydomain.com</pre>		subjectAltName = DNS:www.mydomain.com,DNS:mydomain.com,DNS:other.mydomain.com</pre>
	There is some debate whether wildcard domains can be SANs. I think they can.<p>		There is some debate whether wildcard domains can be SANs. I think they can.<p>
	Now create the CSR for the website.<pre>$ openssl req -new -key www.mydomain.com.key -sha256 -config openssl.cnf -subj 'C=GB/ST=Yorkshire/L=Leeds/O=Company Name/OU=Company IT Dept/CN=www.mydomain.com' > www.mydomain.com.csr</pre>		Now create the CSR for the website.<pre>$ openssl req -new -key www.mydomain.com.key -sha256 -config openssl.cnf -subj '/C=GB/ST=Yorkshire/L=Leeds/O=Company Name/OU=Company IT Dept/CN=www.mydomain.com' > www.mydomain.com.csr</pre>

	The file <i>www.mydomain.com.csr</i> can be provided to the certificate authority for signing.		The file <i>www.mydomain.com.csr</i> can be provided to the certificate authority for signing.

2022-09-21T13:51:44Z

Typo

← Older revision		Revision as of 13:51, 21 September 2022
Line 89:		Line 89:
	# Make a local copy of openssl.cnf		# Make a local copy of openssl.cnf
	# Uncomment the line about v3_extensions<pre>req_extensions = v3_req</pre>		# Uncomment the line about v3_extensions<pre>req_extensions = v3_req</pre>
	# Add a ~~subjectAlternativeName~~ under basicConstraints and keyUsage		# Add a subjectAltName under basicConstraints and keyUsage
	<pre>basicConstraints = CA:FALSE		<pre>basicConstraints = CA:FALSE
	keyUsage = nonRepudiation, digitalSignature, keyEncipherment		keyUsage = nonRepudiation, digitalSignature, keyEncipherment

2022-09-21T13:49:21Z

Added website keys and CSRs

← Older revision		Revision as of 13:49, 21 September 2022
Line 81:		Line 81:

	[Next, details about the openssl pipeline to sign and encrypt the smime attachment.]		[Next, details about the openssl pipeline to sign and encrypt the smime attachment.]
			== Keys and CSRs for websites ==
			=== Create Key ===
			Create the new RSA key. This should be done for each new certificate and should remain on the server it is intended for.
			<pre>$ openssl genrsa -out www.mydomain.com.key 2048
			$ chmod 400 www.mydomain.com.key</pre>
			=== Create CSR ===
			# Make a local copy of openssl.cnf
			# Uncomment the line about v3_extensions<pre>req_extensions = v3_req</pre>
			# Add a subjectAlternativeName under basicConstraints and keyUsage
			<pre>basicConstraints = CA:FALSE
			keyUsage = nonRepudiation, digitalSignature, keyEncipherment
			subjectAltName = DNS:www.mydomain.com,DNS:mydomain.com,DNS:other.mydomain.com</pre>
			There is some debate whether wildcard domains can be SANs. I think they can.<p>
			Now create the CSR for the website.<pre>$ openssl req -new -key www.mydomain.com.key -sha256 -config openssl.cnf -subj 'C=GB/ST=Yorkshire/L=Leeds/O=Company Name/OU=Company IT Dept/CN=www.mydomain.com' > www.mydomain.com.csr</pre>

			The file <i>www.mydomain.com.csr</i> can be provided to the certificate authority for signing.

2022-09-14T20:52:21Z

Added details for work in progress.

@@ Line 14: / Line 14: @@
 This is how to create a self-signed S/MIME certificate, used for email encryption and decryption in an email client.
-First, generate your new key:
+First, generate your new key for the sender:
 <pre>$ openssl genrsa -out smime.key 2048</pre>
 Then create a [[Certificate Signing Request]]:
@@ Line 39: / Line 39: @@
 </pre>
 Then sign the [[Certificate Signing Request|CSR]] using your own [[Certificate Authority]].
-$ openssl x509 -req -days 730 -in csr/smime.csr -CA certs/intermediate.crt -CAkey private/intermediate.key -set_serial 1 -out ../smime/smime.crt
+<pre>$ openssl x509 -req -days 730 -in csr/smime.csr -CA certs/intermediate.crt -CAkey private/intermediate.key -set_serial 1 -out ../smime/smime.crt</pre>
-T.B.C....
+Then the receiver needs to create a key and a certificate signing request. This is their server.