Creating a Self-Signed Certificate: Difference between revisions
DrEdWilliams (talk | contribs) (Created page with "You can do that in one command: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 You can also add '''-nodes''' if you don't want to protect your p...") |
DrEdWilliams (talk | contribs) m (adding text about docker dertificate recognition) Tag: visualeditor |
||
| (6 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
= Creating Certificates = | |||
== Standard Certificates == | |||
You can do that in one command: | You can do that in one command: | ||
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 | openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes | ||
The '''-nodes''' option disables protecting your cert with a passphrase, otherwise it will prompt you for "at least a 4 character" password. The days parameter (365) you can replace with any number to affect expiration date. It will then prompt you for things like "Country Name" but you can just hit enter and accept defaults. | |||
Self-signed certs are not validated with any third party unless you import them to the browsers previously. If you need more security, you should use a certificate signed by a CA | Self-signed certs are not validated with any third party unless you import them to the browsers previously. If you need more security, you should use a certificate signed by a CA | ||
Add '''-subj '/CN=localhost'''' to suppress questions about the contents of the certificate (replace localhost with your desired domain) | Add '''-subj '/CN=localhost'''' to suppress questions about the contents of the certificate (replace localhost with your desired domain) | ||
Reading/Verifying a certificate | == Creating a Cert with a SAN == | ||
Create a file named ''san.cnf'' with the following information: | |||
<pre>[req] | |||
distinguished_name = req_distinguished_name | |||
x509_extensions = v3_req | |||
prompt = no | |||
[req_distinguished_name] | |||
C = US | |||
ST = VA | |||
L = SomeCity | |||
O = MyCompany | |||
OU = MyDivision | |||
CN = www.company.com | |||
[v3_req] | |||
keyUsage = keyEncipherment, dataEncipherment | |||
extendedKeyUsage = serverAuth | |||
subjectAltName = @alt_names | |||
[alt_names] | |||
DNS.1 = www.company.net | |||
DNS.2 = company.com | |||
DNS.3 = company.net</pre> | |||
Note: alt_names section is the one you have to change for additional DNS. You can also use ''IP.1'' entries to insert IP addresses as SANs | |||
Save the file and execute the following OpenSSL command, which will generate PEM and KEY file | |||
openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout sancert.key -out sancert.pem -config san.cnf -extensions 'v3_req' | |||
== Converting .crt to .pem == | |||
In most cases, a simple copy or rename will suffice, but if necessary, use openssl to convert the certificate: | |||
openssl x509 -in sancert.crt -out sancert.pem -outform PEM | |||
== Reading/Verifying a certificate == | |||
openssl x509 -in cert.pem -text -noout | |||
= Installing Certificates = | |||
To avoid the "we don't like self-signed certs" issues with some applications, [[Adding a certificate to the system store|install the certificate in the OS trusted bundle.]] Note that this does NOT work with docker, which has it's own trusted certificate store for registries. | |||
Latest revision as of 13:03, 9 October 2021
Creating Certificates[edit]
Standard Certificates[edit]
You can do that in one command:
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
The -nodes option disables protecting your cert with a passphrase, otherwise it will prompt you for "at least a 4 character" password. The days parameter (365) you can replace with any number to affect expiration date. It will then prompt you for things like "Country Name" but you can just hit enter and accept defaults. Self-signed certs are not validated with any third party unless you import them to the browsers previously. If you need more security, you should use a certificate signed by a CA
Add -subj '/CN=localhost' to suppress questions about the contents of the certificate (replace localhost with your desired domain)
Creating a Cert with a SAN[edit]
Create a file named san.cnf with the following information:
[req] distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no [req_distinguished_name] C = US ST = VA L = SomeCity O = MyCompany OU = MyDivision CN = www.company.com [v3_req] keyUsage = keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1 = www.company.net DNS.2 = company.com DNS.3 = company.net
Note: alt_names section is the one you have to change for additional DNS. You can also use IP.1 entries to insert IP addresses as SANs
Save the file and execute the following OpenSSL command, which will generate PEM and KEY file
openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout sancert.key -out sancert.pem -config san.cnf -extensions 'v3_req'
Converting .crt to .pem[edit]
In most cases, a simple copy or rename will suffice, but if necessary, use openssl to convert the certificate:
openssl x509 -in sancert.crt -out sancert.pem -outform PEM
Reading/Verifying a certificate[edit]
openssl x509 -in cert.pem -text -noout
Installing Certificates[edit]
To avoid the "we don't like self-signed certs" issues with some applications, install the certificate in the OS trusted bundle. Note that this does NOT work with docker, which has it's own trusted certificate store for registries.