|
1 |
|
2 ========== |
|
3 SSL, TLS |
|
4 ========== |
|
5 .. contents:: |
|
6 :local: |
|
7 |
|
8 Generate a self-signed certificate |
|
9 ================================== |
|
10 |
|
11 ``openssl`` allows to generate self-signed certificate by a single command (``-newkey`` |
|
12 instructs to generate a private key and ``-x509`` instructs to issue a self-signed |
|
13 certificate instead of a signing request):: |
|
14 |
|
15 openssl req -x509 -newkey rsa:4096 \ |
|
16 -keyout my.key -passout pass:123456 -out my.crt \ |
|
17 -days 365 \ |
|
18 -subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal \ |
|
19 -addext "subjectAltName = DNS:localhost,DNS:web.internal,email:me@mail.internal" \ |
|
20 -addext keyUsage=digitalSignature -addext extendedKeyUsage=serverAuth |
|
21 |
|
22 You can generate a private key and construct a self-signing certificate in separate steps:: |
|
23 |
|
24 openssl genrsa -out my.key -passout pass:123456 2048 |
|
25 |
|
26 openssl req -x509 \ |
|
27 -key my.key -passin pass:123456 -out my.csr \ |
|
28 -days 3650 \ |
|
29 -subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal \ |
|
30 -addext "subjectAltName = DNS:localhost,DNS:web.internal,email:me@mail.internal" \ |
|
31 -addext keyUsage=digitalSignature -addext extendedKeyUsage=serverAuth |
|
32 |
|
33 Review the resulting certificate:: |
|
34 |
|
35 openssl x509 -text -noout -in my.crt |
|
36 |
|
37 .. note:: |
|
38 With ``openssl`` we can add an extra step: |
|
39 |
|
40 * generate private key (``openssl genrsa``) |
|
41 * generate CSR (``openssl req -new``) |
|
42 * sign CSR with private key (``openssl x509``) |
|
43 |
|
44 The problem here is that ``openssl x509`` doesn't support ``-addext`` like option so we |
|
45 need to craft a config file... Of cause with Bash syntax ``<(...)`` we can add required |
|
46 extensions:: |
|
47 |
|
48 openssl genrsa -out my.key -passout pass:123456 2048 |
|
49 |
|
50 openssl req -new \ |
|
51 -key my.key -passin pass:123456 -out my.csr \ |
|
52 -subj /CN=localhost/O=home/C=US/emailAddress=me@mail.internal |
|
53 |
|
54 openssl x509 -req \ |
|
55 -in my.csr -signkey my.key -passin pass:123456 -out my.crt \ |
|
56 -days 3650 -CAcreateserial \ |
|
57 -extensions v3_ca \ |
|
58 -extfile <( \ |
|
59 echo "[v3_ca]"; \ |
|
60 echo "extendedKeyUsage=serverAuth"; \ |
|
61 echo "subjectAltName=DNS:localhost,DNS:web.internal,email:me@mail.internal") |
|
62 |
|
63 Java ``keytool`` creates PKCS#12 store:: |
|
64 |
|
65 keytool -genkeypair -keystore my.p12 -alias master \ |
|
66 -storetype pkcs12 -keyalg RSA -keysize 2048 -validity 3650 \ |
|
67 -storepass 123456 \ |
|
68 -dname "CN=localhost,O=home,C=US" \ |
|
69 -ext 'san=dns:localhost,dns:web.internal,email:me@mail.internal' |
|
70 |
|
71 To export the self-signed certificate:: |
|
72 |
|
73 keytool -exportcert -keystore my.p12 -file my.crt \ |
|
74 -alias master -rfc -storepass 123456 |
|
75 |
|
76 Review the resulting certificate:: |
|
77 |
|
78 keytool -printcert -file my.crt |
|
79 |
|
80 https://stackoverflow.com/questions/10175812/how-to-create-a-self-signed-certificate-with-openssl/64733092#64733092 |
|
81 How to create a self-signed certificate with OpenSSL. |
|
82 |
|
83 Verify self-signed certificate |
|
84 ============================== |
|
85 |
|
86 Use a private key and corresponding self-signed certificate to launch a server:: |
|
87 |
|
88 openssl s_server -accept 8000 -www -key my.key -cert my.crt |
|
89 |
|
90 Clients should use self-signed certificate for verification:: |
|
91 |
|
92 echo | openssl s_client -servername localhost -connect localhost:8000 -CAfile my.crt |
|
93 |
|
94 curl -v --cacert my.crt https://localhost:8000 |
|
95 |
|
96 There is no certificate chain so the check is trivial for self-signed certificates... |