author | Oleksandr Gavenko <gavenkoa@gmail.com> |
Thu, 12 May 2022 15:15:03 +0300 | |
changeset 2526 | 8f83c9cd3059 |
parent 2492 | bd3d45148652 |
permissions | -rw-r--r-- |
2450
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
1 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
2 |
========== |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
3 |
SSL, TLS |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
4 |
========== |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
5 |
.. contents:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
6 |
:local: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
7 |
|
2451 | 8 |
Generate private keys |
9 |
===================== |
|
10 |
||
11 |
Generate RSA key (last argument is a key bit size):: |
|
12 |
||
13 |
openssl genrsa -des3 -out my.key -passout pass:123456 2048 |
|
14 |
||
15 |
Generate DSA key:: |
|
16 |
||
17 |
openssl gendsa -out my.key -passout pass:123456 <(openssl dsaparam 512) |
|
18 |
||
2453
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
19 |
Select DSA curve:: |
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
20 |
|
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
21 |
openssl ecparam -list_curves |
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
22 |
|
2526
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
23 |
Show key details:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
24 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
25 |
openssl rsa -text -noout -in my.key |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
26 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
27 |
Generate public key:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
28 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
29 |
openssl rsa -pubout -in my.key -out my.pem |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
30 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
31 |
Create CSR |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
32 |
========== |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
33 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
34 |
Generate CSR with a private key:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
35 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
36 |
openssl req -new -newkey rsa:2048 -nodes |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
37 |
-keyout my.key -out my.csr \ |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
38 |
-subj "/C=US/ST=California/L=Los Angeles/O=Evil/CN=me@mail.com" |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
39 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
40 |
Generate CSR from a private key:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
41 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
42 |
openssl req -new -nodes -key my.key -out my.csr |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
43 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
44 |
openssl req -new -nodes -key my.key -out my.csr \ |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
45 |
-subj "/C=US/ST=California/L=Los Angeles/O=Evil/CN=me@mail.com" |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
46 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
47 |
Recreate signing request from certificate:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
48 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
49 |
openssl x509 -x509toreq -in my.crt -signkey my.key -out my.csr |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
50 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
51 |
Review CSR:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
52 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
53 |
openssl req -text -noout -in my.csr |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
54 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
55 |
Verify CSR:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
56 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
57 |
openssl req -text -noout -verify -in my.csr |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
58 |
|
2450
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
59 |
Generate a self-signed certificate |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
60 |
================================== |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
61 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
62 |
``openssl`` allows to generate self-signed certificate by a single command (``-newkey`` |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
63 |
instructs to generate a private key and ``-x509`` instructs to issue a self-signed |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
64 |
certificate instead of a signing request):: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
65 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
66 |
openssl req -x509 -newkey rsa:4096 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
67 |
-keyout my.key -passout pass:123456 -out my.crt \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
68 |
-days 365 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
69 |
-subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
70 |
-addext "subjectAltName = DNS:localhost,DNS:web.internal,email:me@mail.internal" \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
71 |
-addext keyUsage=digitalSignature -addext extendedKeyUsage=serverAuth |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
72 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
73 |
You can generate a private key and construct a self-signing certificate in separate steps:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
74 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
75 |
openssl genrsa -out my.key -passout pass:123456 2048 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
76 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
77 |
openssl req -x509 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
78 |
-key my.key -passin pass:123456 -out my.csr \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
79 |
-days 3650 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
80 |
-subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
81 |
-addext "subjectAltName = DNS:localhost,DNS:web.internal,email:me@mail.internal" \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
82 |
-addext keyUsage=digitalSignature -addext extendedKeyUsage=serverAuth |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
83 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
84 |
Review the resulting certificate:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
85 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
86 |
openssl x509 -text -noout -in my.crt |
2526
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
87 |
keytool -printcert -file my.crt |
2450
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
88 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
89 |
.. note:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
90 |
With ``openssl`` we can add an extra step: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
91 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
92 |
* generate private key (``openssl genrsa``) |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
93 |
* generate CSR (``openssl req -new``) |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
94 |
* sign CSR with private key (``openssl x509``) |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
95 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
96 |
The problem here is that ``openssl x509`` doesn't support ``-addext`` like option so we |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
97 |
need to craft a config file... Of cause with Bash syntax ``<(...)`` we can add required |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
98 |
extensions:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
99 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
100 |
openssl genrsa -out my.key -passout pass:123456 2048 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
101 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
102 |
openssl req -new \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
103 |
-key my.key -passin pass:123456 -out my.csr \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
104 |
-subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
105 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
106 |
openssl x509 -req \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
107 |
-in my.csr -signkey my.key -passin pass:123456 -out my.crt \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
108 |
-days 3650 -CAcreateserial \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
109 |
-extensions v3_ca \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
110 |
-extfile <( \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
111 |
echo "[v3_ca]"; \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
112 |
echo "extendedKeyUsage=serverAuth"; \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
113 |
echo "subjectAltName=DNS:localhost,DNS:web.internal,email:me@mail.internal") |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
114 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
115 |
Java ``keytool`` creates PKCS#12 store:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
116 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
117 |
keytool -genkeypair -keystore my.p12 -alias master \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
118 |
-storetype pkcs12 -keyalg RSA -keysize 2048 -validity 3650 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
119 |
-storepass 123456 \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
120 |
-dname "CN=localhost,O=home,C=US" \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
121 |
-ext 'san=dns:localhost,dns:web.internal,email:me@mail.internal' |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
122 |
|
2453
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
123 |
View the keystore:: |
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
124 |
|
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
125 |
keytool -list -v -keystore my.p12 -storepass 123456 |
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
126 |
|
2450
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
127 |
To export the self-signed certificate:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
128 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
129 |
keytool -exportcert -keystore my.p12 -file my.crt \ |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
130 |
-alias master -rfc -storepass 123456 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
131 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
132 |
https://stackoverflow.com/questions/10175812/how-to-create-a-self-signed-certificate-with-openssl/64733092#64733092 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
133 |
How to create a self-signed certificate with OpenSSL. |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
134 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
135 |
Verify self-signed certificate |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
136 |
============================== |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
137 |
|
2526
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
138 |
Review certificate:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
139 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
140 |
openssl x509 -text -noout -in my.crt |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
141 |
|
2450
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
142 |
Use a private key and corresponding self-signed certificate to launch a server:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
143 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
144 |
openssl s_server -accept 8000 -www -key my.key -cert my.crt |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
145 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
146 |
Clients should use self-signed certificate for verification:: |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
147 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
148 |
echo | openssl s_client -servername localhost -connect localhost:8000 -CAfile my.crt |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
149 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
150 |
curl -v --cacert my.crt https://localhost:8000 |
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
151 |
|
3e1990dc6ac8
Generate a self-signed certificate.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
diff
changeset
|
152 |
There is no certificate chain so the check is trivial for self-signed certificates... |
2451 | 153 |
|
154 |
PKCS#12 stores |
|
155 |
============== |
|
156 |
||
2526
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
157 |
PKCS#12 store keeps a private keys and certificates, to combine a private key and certificates into the store:: |
2451 | 158 |
|
159 |
openssl pkcs12 -export -in my.crt -inkey my.key -certfile other.crt -out my.p12 -name master |
|
160 |
||
2453
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
161 |
Show info about PKCS#12 store:: |
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
162 |
|
2492 | 163 |
openssl pkcs12 -info -in my.p12 -passin pass:123456 -nodes |
2453
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
164 |
keytool -list -v -keystore my.p12 -storepass 123456 |
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
165 |
|
2451 | 166 |
To export a private key to PKCS#8 format (has header ``BEGIN PRIVATE KEY`` or ``BEGIN ENCRYPTED |
167 |
PRIVATE KEY``):: |
|
168 |
||
169 |
openssl pkcs12 -info -nocerts -in my.p12 -passin pass:123456 -nodes |
|
170 |
||
2526
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
171 |
To extract private key and convert to PKCS#1 format (PEM, has header ``BEGIN RSA PRIVATE KEY`` or |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
172 |
``BEGIN DSA PRIVATE KEY``):: |
2451 | 173 |
|
174 |
openssl pkcs12 -info -nocerts -in my.p12 -passin pass:123456 -nodes | openssl rsa |
|
175 |
||
176 |
To show private key info:: |
|
177 |
||
178 |
openssl pkcs12 -info -nocerts -in my.p12 -passin pass:123456 -nodes | openssl rsa -text -noout |
|
179 |
||
2453
5bb8692c080a
Show info about PKCS#12 store.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2451
diff
changeset
|
180 |
To show certificate info:: |
2451 | 181 |
|
182 |
openssl pkcs12 -info -nokeys -in my.p12 -passin pass:123456 |
|
183 |
openssl pkcs12 -info -nokeys -in my.p12 -passin pass:123456 | openssl x509 -text -noout |
|
184 |
||
2526
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
185 |
Convert DER to PEM |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
186 |
================== |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
187 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
188 |
Convert a private key from DER to PEM:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
189 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
190 |
openssl rsa -inform DER -in priv.der -outform PEM -out priv.pem |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
191 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
192 |
Convert a certificate from DER to PEM:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
193 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
194 |
openssl x509 -inform DER -in cert.der -outform PEM -out cert.crt |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
195 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
196 |
Convert PEM to DER |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
197 |
================== |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
198 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
199 |
Convert a private key from PEM to DER:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
200 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
201 |
openssl rsa -inform PEM -in priv.pem -outform DER -out priv.der |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
202 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
203 |
Convert a certificate from PEM to DER:: |
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
204 |
|
8f83c9cd3059
Create CSR. Convert PEM to DER.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2492
diff
changeset
|
205 |
openssl x509 -inform PEM -in cert.pem -outform DER -out cert.crt |