Creating a Self-Signed Certificate - Revision history

DrEdWilliams: adding text about docker dertificate recognition

2021-10-09T13:03:18Z

adding text about docker dertificate recognition

← Older revision		Revision as of 13:03, 9 October 2021
Line 53:		Line 53:

	= Installing Certificates =		= Installing Certificates =
	To avoid the "we don't like self-signed certs" issues with some applications, [[Adding a certificate to the system store\|install the certificate in the OS trusted bundle]]		To avoid the "we don't like self-signed certs" issues with some applications, [[Adding a certificate to the system store\|install the certificate in the OS trusted bundle.]] Note that this does NOT work with docker, which has it's own trusted certificate store for registries.

DrEdWilliams: removed duplicate instructions, instead referring to a separate page

2021-10-09T13:01:50Z

removed duplicate instructions, instead referring to a separate page

← Older revision		Revision as of 13:01, 9 October 2021
Line 53:		Line 53:

	= Installing Certificates =		= Installing Certificates =
	~~== Debian/Ubuntu ==~~		To avoid the "we don't like self-signed certs" issues with some applications, [[Adding a certificate to the system store\|install the certificate in the OS trusted bundle]]

	~~Copy~~ the certificate ~~(in .pem format):~~

	~~sudo cp domain.pem /usr/local/shared/ca-certificates/~~

	~~Update~~ the ~~CA bundle:~~

	~~sudo update-ca-certificates~~

	~~== CentOS/Fedora ==~~

	~~Copy~~ the certificate (in ~~.crt format):~~

	~~sudo cp domain.crt /etc/pki/ca-trust/source/anchors/~~

	~~Update~~ the CA bundle:

	~~sudo update-ca-trust extract~~

DrEdWilliams: /* Reading/Verifying a certificate */

2021-05-23T12:13:36Z

Reading/Verifying a certificate

← Older revision		Revision as of 12:13, 23 May 2021
Line 51:		Line 51:

	openssl x509 -in cert.pem -text -noout		openssl x509 -in cert.pem -text -noout

			= Installing Certificates =
			== Debian/Ubuntu ==

			Copy the certificate (in .pem format):

			sudo cp domain.pem /usr/local/shared/ca-certificates/

			Update the CA bundle:

			sudo update-ca-certificates

			== CentOS/Fedora ==

			Copy the certificate (in .crt format):

			sudo cp domain.crt /etc/pki/ca-trust/source/anchors/

			Update the CA bundle:

			sudo update-ca-trust extract

DrEdWilliams: /* Standard Certificates */

2021-05-23T12:07:20Z

Standard Certificates

← Older revision		Revision as of 12:07, 23 May 2021
Line 1:		Line 1:
			= Creating Certificates =

	== Standard Certificates ==		== Standard Certificates ==

DrEdWilliams: /* Converting .pem to .crt */

2021-05-22T16:49:12Z

Converting .pem to .crt

← Older revision		Revision as of 16:49, 22 May 2021
Line 40:		Line 40:
	openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout sancert.key -out sancert.pem -config san.cnf -extensions 'v3_req'		openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout sancert.key -out sancert.pem -config san.cnf -extensions 'v3_req'

	== Converting .~~pem~~ to .~~crt~~ ==		== Converting .crt to .pem ==

	In most cases, a simple copy or rename will suffice, but if necessary, use openssl to convert the certificate:		In most cases, a simple copy or rename will suffice, but if necessary, use openssl to convert the certificate:

DrEdWilliams: /* Creating a Cert with a SAN */

2021-05-22T16:46:06Z

Creating a Cert with a SAN

← Older revision		Revision as of 16:46, 22 May 2021
Line 12:		Line 12:
	== Creating a Cert with a SAN ==		== Creating a Cert with a SAN ==

	~~(from https://geekflare.com/san-ssl-certificate/)~~

	Create a file named ''san.cnf'' with the following information:		Create a file named ''san.cnf'' with the following information:
	<pre>[ req ]		<pre>[req]
	~~default_bits = 2048~~
	distinguished_name = req_distinguished_name		distinguished_name = req_distinguished_name
	~~req_extensions~~ = ~~req_ext~~		x509_extensions = v3_req
	[ req_distinguished_name ]		prompt = no
	~~countryName~~ = ~~Country Name (2 letter code)~~		[req_distinguished_name]
	~~stateOrProvinceName~~ = ~~State or Province Name (full name)~~		C = US
	~~localityName~~ = ~~Locality Name (eg, city)~~		ST = VA
	~~organizationName~~ = ~~Organization Name (eg, company)~~		L = SomeCity
	~~commonName~~ = ~~Common Name (e~~.g. ~~server FQDN or YOUR name)~~		O = MyCompany
	[ ~~req_ext~~ ]		OU = MyDivision
			CN = www.company.com
			[v3_req]
			keyUsage = keyEncipherment, dataEncipherment
			extendedKeyUsage = serverAuth
	subjectAltName = @alt_names		subjectAltName = @alt_names
	[alt_names]		[alt_names]
	DNS.1 = ~~bestflare~~.~~com~~		DNS.1 = www.company.net
	DNS.2 = ~~usefulread~~.com		DNS.2 = company.com
	DNS.3 = ~~chandank~~.~~com~~</pre>		DNS.3 = company.net</pre>

	Note: alt_names section is the one you have to change for additional DNS. You can also use ''IP.1'' entries to insert IP addresses as SANs		Note: alt_names section is the one you have to change for additional DNS. You can also use ''IP.1'' entries to insert IP addresses as SANs

	Save the file and execute the following OpenSSL command, which will generate ~~CSR~~ and KEY file		Save the file and execute the following OpenSSL command, which will generate PEM and KEY file

	openssl req -~~out sancert.csr~~ -newkey rsa:2048 ~~-nodes~~ -keyout sancert.key -config san.cnf		openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout sancert.key -out sancert.pem -config san.cnf -extensions 'v3_req'

	~~This will create sslcert.csr and private.key in the present working directory. Then you can turn that CSR into a certificate using this command:~~

	~~openssl x509~~ -~~req -days 365 -in sancert.csr -signkey sancert.key -sha256 -out sancert.crt~~

	== Converting .pem to .crt ==		== Converting .pem to .crt ==

DrEdWilliams at 16:25, 22 May 2021

2021-05-22T16:25:47Z

@@ Line 1: / Line 1: @@
 You can do that in one command:
-  openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
+  openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
-You can also add '''-nodes''' if you don't want to protect your private key with a passphrase, otherwise it will prompt you for "at least a 4 character" password. The days parameter (365) you can replace with any number to affect expiration date. It will then prompt you for things like "Country Name" but you can just hit enter and accept defaults.
+The '''-nodes''' option disables protecting your cert with a passphrase, otherwise it will prompt you for "at least a 4 character" password. The days parameter (365) you can replace with any number to affect expiration date. It will then prompt you for things like "Country Name" but you can just hit enter and accept defaults.
 Self-signed certs are not validated with any third party unless you import them to the browsers previously. If you need more security, you should use a certificate signed by a CA
 Add '''-subj '/CN=localhost'''' to suppress questions about the contents of the certificate (replace localhost with your desired domain)
-Reading/Verifying a certificate
+== Creating a Cert with a SAN ==
-  openssl x509 -in certificate.crt -text -noout
+  openssl x509 -in cert.pem -text -noout

DrEdWilliams: Created page with "You can do that in one command: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 You can also add '''-nodes''' if you don't want to protect your p..."

2019-08-03T01:27:59Z

Created page with "You can do that in one command: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 You can also add '''-nodes''' if you don't want to protect your p..."

New page

You can do that in one command:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

You can also add '''-nodes''' if you don't want to protect your private key with a passphrase, otherwise it will prompt you for "at least a 4 character" password. The days parameter (365) you can replace with any number to affect expiration date. It will then prompt you for things like "Country Name" but you can just hit enter and accept defaults.
Self-signed certs are not validated with any third party unless you import them to the browsers previously. If you need more security, you should use a certificate signed by a CA

Add '''-subj '/CN=localhost'''' to suppress questions about the contents of the certificate (replace localhost with your desired domain)

Reading/Verifying a certificate

openssl x509 -in certificate.crt -text -noout