Creating a CA and certificates - Revision history

DrEdWilliams: /* Helper Scripts */

2021-11-06T14:00:36Z

Helper Scripts

← Older revision		Revision as of 14:00, 6 November 2021
Line 31:		Line 31:

	=== Create PKCS12 Keystore ===		=== Create PKCS12 Keystore ===
	openssl pkcs12 -export -in ~~server.crt~~ -inkey ~~server.~~key \		openssl pkcs12 -export -in <cert file> -inkey <key file> \
	-out ~~server~~.p12 -name [~~some-alias~~] \		-out <cert name>.p12 -name [<cert.name>] \
	-CAfile ~~ca.crt~~ -caname root		-CAfile <CAcert> -caname root

	~~'''Note:''' Make sure you put a password on the pkcs12 file - otherwise you'll get a null pointer exception when you try to import it.~~

	=== Validating that a key/crt is correct ===		=== Validating that a key/crt is correct ===
Line 47:		Line 45:
	cert-create <CN> <CAcert> <CAkey> <cert file>		cert-create <CN> <CAcert> <CAkey> <cert file>
	cert-create-san <hostname> <CAcert> <CAkey> <cert file>		cert-create-san <hostname> <CAcert> <CAkey> <cert file>
			cert-import-keystore <cert file> <key file> <CAcert> <base name>

DrEdWilliams at 13:50, 6 November 2021

2021-11-06T13:50:58Z

← Older revision		Revision as of 13:50, 6 November 2021
Line 29:		Line 29:
	Some applications (OpenSearch included) require all keys to be in PKCS8 format:		Some applications (OpenSearch included) require all keys to be in PKCS8 format:
	openssl pkcs8 -inform PEM -outform PEM -in <cert file>.key -topk8 -nocrypt -v1 PBE-SHA1-3DES -out <cert files>-pkcs8.key		openssl pkcs8 -inform PEM -outform PEM -in <cert file>.key -topk8 -nocrypt -v1 PBE-SHA1-3DES -out <cert files>-pkcs8.key

			=== Create PKCS12 Keystore ===
			openssl pkcs12 -export -in server.crt -inkey server.key \
			-out server.p12 -name [some-alias] \
			-CAfile ca.crt -caname root

			'''Note:''' Make sure you put a password on the pkcs12 file - otherwise you'll get a null pointer exception when you try to import it.

	=== Validating that a key/crt is correct ===		=== Validating that a key/crt is correct ===

DrEdWilliams at 13:45, 6 November 2021

2021-11-06T13:45:11Z

← Older revision		Revision as of 13:45, 6 November 2021
Line 1:		Line 1:
	~~from:~~		=== Create the CA Key and Certificate ===
	~~https~~://~~deliciousbrains.com~~/~~ssl~~-~~certificate~~-~~authority-for-local-https-development/~~		openssl req -x509 -newkey rsa:2048 -nodes -days 9999 -subj /O=WilliamsNet/C=US/CN=<CA name>/ -keyout <CA file>.key -out <CA file>.crt

	Create the ~~CA Key and~~ Certificate:		=== Create the Certificate Signing Request ===
			openssl req -newkey rsa:2048 -nodes -subj /O=WilliamsNet/C=US/CN=<cert CN>/ -keyout <cert file>.key -out <cert file>.csr

	openssl ~~genrsa~~ -~~out WilliamsNetCA~~.~~key 2048~~		=== Create the Certificate ===
	~~openssl req~~ -~~x509~~ -~~new~~ -~~nodes~~ -~~key WilliamsNetCA~~.~~key -sha256~~ -days ~~1825~~ -~~out WilliamsNetCA.pem~~		If just a simple certificated is needed, this can be done in one step:
			openssl x509 -req -in <cert file>.csr -CA <CA cert> -CAkey <CA key> -CAcreateserial -out <cert file>.crt -days 9999 -sha256

	Create a ~~key for the new cert:~~		=== Create a Certificate with SAN ===
			If a certificate with SAN entries is needed, a configuration file is needed to specify the SAN items required. The CN itself (specified when creating the certificate request) should be included as one of the SAN entries, as some newer applications actually ignore the CN:
	~~openssl genrsa -out kibana.key 2048~~

	~~Create the~~ Certificate ~~Signing Request:~~
	~~openssl req -new -key kibana.key -out kibana.csr~~

	~~Create the~~ file to ~~support~~ the certificate ~~generation (kibana.cnf~~):

	authorityKeyIdentifier=keyid,issuer		authorityKeyIdentifier=keyid,issuer
Line 27:		Line 23:

	Create the certificate:		Create the certificate:
	openssl x509 -req -in ~~kibana~~.csr -CA ~~WilliamsNetCA.pem~~ -CAkey ~~WilliamsNetCA.~~key -CAcreateserial -out ~~kibana~~.crt -days 9999 -sha256 -extfile ~~kibana~~.cnf		openssl x509 -req -in <cert file>.csr -CA <CA cert> -CAkey <CA key> -CAcreateserial -out <cert file>.crt -days 9999 -sha256 \
			-extfile <cert file>.cnf

			=== Convert Key to PKCS8 Format ===
			Some applications (OpenSearch included) require all keys to be in PKCS8 format:
			openssl pkcs8 -inform PEM -outform PEM -in <cert file>.key -topk8 -nocrypt -v1 PBE-SHA1-3DES -out <cert files>-pkcs8.key

	~~Create~~ a ~~PKCS8 format~~ key ~~if needed:~~		=== Validating that a key/crt is correct ===
	openssl ~~pkcs8~~ -~~inform PEM~~ -outform ~~PEM~~ -in ~~node-1-admin~~.~~pem~~ -~~topk8~~ -~~nocrypt~~ -~~v1 PBE~~-~~SHA1~~-~~3DES~~ -~~out node~~-1-~~admin-key~~.~~pem~~		openssl pkey -pubout -outform pem -in privateKey.key \| sha256sum
			openssl x509 -pubkey -noout -outform pem -in certificate.crt \| sha256sum
			openssl req -pubkey -noout -outform pem -in CSR.csr \| sha256sum

	~~VAlidating that a key~~/~~crt is correct~~:		=== Helper Scripts ===
	~~openssl pkey~~ -~~in privateKey.key~~ -~~pubout -outform pem \| sha256sum~~		Helper scripts are in the repository (and in /work/bin):
	~~openssl x509~~ -~~in certificate.crt -pubkey -noout -outform pem \| sha256sum~~		cert-create-ca <CA name> <CA file>
	~~openssl req -in CSR.csr -pubkey~~ -~~noout~~ -~~outform pem \| sha256sum~~		cert-create <CN> <CAcert> <CAkey> <cert file>
			cert-create-san <hostname> <CAcert> <CAkey> <cert file>

DrEdWilliams at 18:13, 20 June 2021

2021-06-20T18:13:03Z

← Older revision		Revision as of 18:13, 20 June 2021
Line 28:		Line 28:
	Create the certificate:		Create the certificate:
	openssl x509 -req -in kibana.csr -CA WilliamsNetCA.pem -CAkey WilliamsNetCA.key -CAcreateserial -out kibana.crt -days 9999 -sha256 -extfile kibana.cnf		openssl x509 -req -in kibana.csr -CA WilliamsNetCA.pem -CAkey WilliamsNetCA.key -CAcreateserial -out kibana.crt -days 9999 -sha256 -extfile kibana.cnf

			Create a PKCS8 format key if needed:
			openssl pkcs8 -inform PEM -outform PEM -in node-1-admin.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out node-1-admin-key.pem

	VAlidating that a key/crt is correct:		VAlidating that a key/crt is correct:

DrEdWilliams at 12:49, 20 June 2021

2021-06-20T12:49:39Z

← Older revision		Revision as of 12:49, 20 June 2021
Line 1:		Line 1:
			from:
			https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/

	Create the CA Key and Certificate:		Create the CA Key and Certificate:

DrEdWilliams at 01:21, 20 June 2021

2021-06-20T01:21:02Z

← Older revision		Revision as of 01:21, 20 June 2021
Line 3:		Line 3:
	openssl genrsa -out WilliamsNetCA.key 2048		openssl genrsa -out WilliamsNetCA.key 2048
	openssl req -x509 -new -nodes -key WilliamsNetCA.key -sha256 -days 1825 -out WilliamsNetCA.pem		openssl req -x509 -new -nodes -key WilliamsNetCA.key -sha256 -days 1825 -out WilliamsNetCA.pem

			Create a key for the new cert:

			openssl genrsa -out kibana.key 2048

	Create the Certificate Signing Request:		Create the Certificate Signing Request:

DrEdWilliams: Created page with "Create the CA Key and Certificate: openssl genrsa -out WilliamsNetCA.key 2048 openssl req -x509 -new -nodes -key WilliamsNetCA.key -sha256 -days 1825 -out WilliamsNetCA.pem..."

2021-06-20T01:16:34Z

Created page with "Create the CA Key and Certificate: openssl genrsa -out WilliamsNetCA.key 2048 openssl req -x509 -new -nodes -key WilliamsNetCA.key -sha256 -days 1825 -out WilliamsNetCA.pem..."

New page

Create the CA Key and Certificate:

openssl genrsa -out WilliamsNetCA.key 2048
openssl req -x509 -new -nodes -key WilliamsNetCA.key -sha256 -days 1825 -out WilliamsNetCA.pem

Create the Certificate Signing Request:
openssl req -new -key kibana.key -out kibana.csr

Create the file to support the certificate generation (kibana.cnf):

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = 10.0.0.61
DNS.2 = compute1.williams.localnet
DNS.3 = compute1

Create the certificate:
openssl x509 -req -in kibana.csr -CA WilliamsNetCA.pem -CAkey WilliamsNetCA.key -CAcreateserial -out kibana.crt -days 9999 -sha256 -extfile kibana.cnf

VAlidating that a key/crt is correct:
openssl pkey -in privateKey.key -pubout -outform pem | sha256sum
openssl x509 -in certificate.crt -pubkey -noout -outform pem | sha256sum
openssl req -in CSR.csr -pubkey -noout -outform pem | sha256sum