OpenSSL

OpenSSLis the widely used encryption layer in UNIX operating systems. The most common day to day use is providing transport layer security to websites, such as this one and indicated by the use of https in the URL.

Points to be covered in this document

• Generating a private key
• Generating a Certificate Signing Request
• Fitting an SSL key
• Verification
• Starting a Certificate Authority.

Will be fleshed out as time allows.

Creating and using S/MIME

This is how to create a self-signed S/MIME certificate, used for email encryption and decryption in an email client.

First, generate your new key for the sender:

$ openssl genrsa -out smime.key 2048

Then create a Certificate Signing Request:

$ openssl req -new -key smime.key -out smime.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:GB
State or Province Name (full name) [Some-State]:Leeds
Locality Name (eg, city) []:Leeds
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Palfreman Trading Ltd
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:William Palfreman
Email Address []:william@palfreman.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Then sign the CSR using your own Certificate Authority.

$ openssl x509 -req -days 730 -in csr/smime.csr -CA certs/intermediate.crt -CAkey private/intermediate.key -set_serial 1 -out ../smime/smime.crt

Then the receiver needs to create a key and a certificate signing request. This is their server.

$ openssl genrsa -out sender-smime.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
........................................................................................+++++
........+++++

Then create the Certificate Request using the new key

$ openssl req -new -key sender-smime.key -out sender-smime.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:GB
State or Province Name (full name) [Some-State]:London
Locality Name (eg, city) []:LONDON
Organization Name (eg, company) [Internet Widgits Pty Ltd]:University of Grantchester
Organizational Unit Name (eg, section) []:Grantchester HostCo
Common Name (e.g. server FQDN or YOUR name) []:William Palfreman
Email Address []:william.palfreman@grantchester.ac.uk

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

The creates a certificate request (CSR) which isn't confidential but I won't list here. Take that CSR to your Certificate Authority (CA) and issue the certificate

$ openssl x509 -req -days 365 -in csr/grant.csr -CA certs/intermediate.crt -CAkey private/intermediate.key -out grant.crt
Certificate request self-signature ok
subject=C = GB, ST = London, L = LONDON, O = University of Granchester, OU = HostCo, CN = William Palfreman, emailAddress = william.palfreman@grantchester.ac.uk
Enter pass phrase for private/intermediate.key:

Then pass the receiver sender certificate back to the sending server.

[Next, details about the openssl pipeline to sign and encrypt the smime attachment.]

Keys and CSRs for websites

Create Key

Create the new RSA key. This should be done for each new certificate and should remain on the server it is intended for.

$ openssl genrsa -out www.mydomain.com.key 2048
$ chmod 400 www.mydomain.com.key

Create CSR

1. Make a local copy of openssl.cnf
2. Uncomment the line about v3_extensions

   req_extensions = v3_req

3. Add a subjectAltName under basicConstraints and keyUsage in [ v3_req ] section.

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = DNS:www.mydomain.com,DNS:mydomain.com,DNS:other.mydomain.com

There is some debate whether wildcard domains can be SANs. I think they can.

Now create the CSR for the website.

$ openssl req -new -key www.mydomain.com.key -sha256 -config openssl.cnf -subj '/C=GB/ST=Yorkshire/L=Leeds/O=Company Name/OU=Company IT Dept/CN=www.mydomain.com' > www.mydomain.com.csr

The file www.mydomain.com.csr can be provided to the certificate authority for signing.

Writing random seed with writerand

Sometimes openssl lacks a random seed and fails. You can easily create a file for this.

$ openssl rand -writerand $HOME/.rnd