author | Oleksandr Gavenko <gavenkoa@gmail.com> |
Sun, 08 Nov 2020 01:01:04 +0200 | |
changeset 2450 | 3e1990dc6ac8 |
child 2451 | 892004bd19bb |
permissions | -rw-r--r-- |
2450
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
1 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
2 |
========== |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
3 |
SSL, TLS |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
4 |
========== |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
5 |
.. contents:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
6 |
:local: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
7 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
8 |
Generate a self-signed certificate |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
9 |
================================== |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
10 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
11 |
``openssl`` allows to generate self-signed certificate by a single command (``-newkey`` |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
12 |
instructs to generate a private key and ``-x509`` instructs to issue a self-signed |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
13 |
certificate instead of a signing request):: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
14 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
15 |
openssl req -x509 -newkey rsa:4096 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
16 |
-keyout my.key -passout pass:123456 -out my.crt \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
17 |
-days 365 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
18 |
-subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
19 |
-addext "subjectAltName = DNS:localhost,DNS:web.internal,email:me@mail.internal" \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
20 |
-addext keyUsage=digitalSignature -addext extendedKeyUsage=serverAuth |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
21 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
22 |
You can generate a private key and construct a self-signing certificate in separate steps:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
23 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
24 |
openssl genrsa -out my.key -passout pass:123456 2048 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
25 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
26 |
openssl req -x509 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
27 |
-key my.key -passin pass:123456 -out my.csr \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
28 |
-days 3650 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
29 |
-subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
30 |
-addext "subjectAltName = DNS:localhost,DNS:web.internal,email:me@mail.internal" \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
31 |
-addext keyUsage=digitalSignature -addext extendedKeyUsage=serverAuth |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
32 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
33 |
Review the resulting certificate:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
34 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
35 |
openssl x509 -text -noout -in my.crt |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
36 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
37 |
.. note:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
38 |
With ``openssl`` we can add an extra step: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
39 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
40 |
* generate private key (``openssl genrsa``) |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
41 |
* generate CSR (``openssl req -new``) |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
42 |
* sign CSR with private key (``openssl x509``) |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
43 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
44 |
The problem here is that ``openssl x509`` doesn't support ``-addext`` like option so we |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
45 |
need to craft a config file... Of cause with Bash syntax ``<(...)`` we can add required |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
46 |
extensions:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
47 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
48 |
openssl genrsa -out my.key -passout pass:123456 2048 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
49 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
50 |
openssl req -new \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
51 |
-key my.key -passin pass:123456 -out my.csr \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
52 |
-subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
53 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
54 |
openssl x509 -req \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
55 |
-in my.csr -signkey my.key -passin pass:123456 -out my.crt \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
56 |
-days 3650 -CAcreateserial \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
57 |
-extensions v3_ca \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
58 |
-extfile <( \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
59 |
echo "[v3_ca]"; \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
60 |
echo "extendedKeyUsage=serverAuth"; \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
61 |
echo "subjectAltName=DNS:localhost,DNS:web.internal,email:me@mail.internal") |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
62 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
63 |
Java ``keytool`` creates PKCS#12 store:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
64 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
65 |
keytool -genkeypair -keystore my.p12 -alias master \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
66 |
-storetype pkcs12 -keyalg RSA -keysize 2048 -validity 3650 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
67 |
-storepass 123456 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
68 |
-dname "CN=localhost,O=home,C=US" \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
69 |
-ext 'san=dns:localhost,dns:web.internal,email:me@mail.internal' |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
70 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
71 |
To export the self-signed certificate:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
72 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
73 |
keytool -exportcert -keystore my.p12 -file my.crt \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
74 |
-alias master -rfc -storepass 123456 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
75 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
76 |
Review the resulting certificate:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
77 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
78 |
keytool -printcert -file my.crt |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
79 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
80 |
https://stackoverflow.com/questions/10175812/how-to-create-a-self-signed-certificate-with-openssl/64733092#64733092 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
81 |
How to create a self-signed certificate with OpenSSL. |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
82 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
83 |
Verify self-signed certificate |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
84 |
============================== |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
85 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
86 |
Use a private key and corresponding self-signed certificate to launch a server:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
87 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
88 |
openssl s_server -accept 8000 -www -key my.key -cert my.crt |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
89 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
90 |
Clients should use self-signed certificate for verification:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
91 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
92 |
echo | openssl s_client -servername localhost -connect localhost:8000 -CAfile my.crt |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
93 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
94 |
curl -v --cacert my.crt https://localhost:8000 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
95 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
96 |
There is no certificate chain so the check is trivial for self-signed certificates... |