Create the root pair - Revision history

imported>Jacob at 21:23, 6 March 2020

2020-03-06T21:23:38Z

← Older revision		Revision as of 16:23, 6 March 2020
Line 105:		Line 105:
	stateOrProvinceName_default = IL		stateOrProvinceName_default = IL
	localityName_default =		localityName_default =
	0.organizationName_default = ~~Sjakio~~		0.organizationName_default = example
	#organizationalUnitName_default =		#organizationalUnitName_default =
	#emailAddress_default =		#emailAddress_default =

imported>Jacob at 03:15, 17 February 2020

2020-02-17T03:15:56Z

← Older revision		Revision as of 22:15, 16 February 2020
Line 102:		Line 102:
	emailAddress = Email Address		emailAddress = Email Address
	# Optionally, specify some defaults.		# Optionally, specify some defaults.
	countryName_default = GB		countryName_default = US
	stateOrProvinceName_default = ~~England~~		stateOrProvinceName_default = IL
	localityName_default =		localityName_default =
	0.organizationName_default = ~~Alice Ltd~~		0.organizationName_default = Sjakio
	#organizationalUnitName_default =		#organizationalUnitName_default =
	#emailAddress_default =		#emailAddress_default =

imported>Jawadmin at 20:54, 23 December 2018

2018-12-23T20:54:55Z

← Older revision		Revision as of 15:54, 23 December 2018
Line 4:		Line 4:
	Next [[Create the intermediate pair]]		Next [[Create the intermediate pair]]
	</span></p><hr>		</span></p><hr>

	~~<hr><p style="text align:left;">~~

	~~<span style="float:right;">~~

	~~</span></p><hr>~~




	Acting as a certificate authority (CA) means dealing with cryptographic pairs of private keys and public certificates. The very first cryptographic pair we’ll create is the root pair. This consists of the root key (ca.key.pem) and root certificate (ca.cert.pem). This pair forms the identity of your CA.		Acting as a certificate authority (CA) means dealing with cryptographic pairs of private keys and public certificates. The very first cryptographic pair we’ll create is the root pair. This consists of the root key (ca.key.pem) and root certificate (ca.cert.pem). This pair forms the identity of your CA.

imported>Jawadmin at 20:51, 23 December 2018

2018-12-23T20:51:36Z

← Older revision		Revision as of 15:51, 23 December 2018
Line 1:		Line 1:
	<hr><p style="text align:left;">		<hr><p style="text align:left;">
	Previous [[]]		Previous [[OpenSSL Certificate Authority]]
	<span style="float:right;">		<span style="float:right;">
	Next [[Create the intermediate pair]]		Next [[Create the intermediate pair]]
Line 247:		Line 247:
	X509v3 Key Usage: critical		X509v3 Key Usage: critical
	Digital Signature, Certificate Sign, CRL Sign		Digital Signature, Certificate Sign, CRL Sign

			<hr><p style="text align:left;">
			Previous [[OpenSSL Certificate Authority]]
			<span style="float:right;">
			Next [[Create the intermediate pair]]
			</span></p>

imported>Jawadmin at 20:50, 23 December 2018

2018-12-23T20:50:23Z

← Older revision		Revision as of 15:50, 23 December 2018
Line 1:		Line 1:
			<hr><p style="text align:left;">
			Previous [[]]
			<span style="float:right;">
			Next [[Create the intermediate pair]]
			</span></p><hr>

	~~Previous [[]] Next [[Create the intermediate pair]]~~		<hr><p style="text align:left;">

			<span style="float:right;">

			</span></p><hr>

imported>Jawadmin at 16:34, 23 December 2018

2018-12-23T16:34:26Z

← Older revision		Revision as of 11:34, 23 December 2018
Line 1:		Line 1:

	Previous [[]] [[Create the intermediate pair]]		Previous [[]] Next [[Create the intermediate pair]]

imported>Jawadmin at 16:34, 23 December 2018

2018-12-23T16:34:04Z

← Older revision		Revision as of 11:34, 23 December 2018
Line 1:		Line 1:

			Previous [[]] [[Create the intermediate pair]]





	Acting as a certificate authority (CA) means dealing with cryptographic pairs of private keys and public certificates. The very first cryptographic pair we’ll create is the root pair. This consists of the root key (ca.key.pem) and root certificate (ca.cert.pem). This pair forms the identity of your CA.		Acting as a certificate authority (CA) means dealing with cryptographic pairs of private keys and public certificates. The very first cryptographic pair we’ll create is the root pair. This consists of the root key (ca.key.pem) and root certificate (ca.cert.pem). This pair forms the identity of your CA.

imported>Jawadmin at 16:23, 23 December 2018

2018-12-23T16:23:50Z

← Older revision		Revision as of 11:23, 23 December 2018
Line 52:		Line 52:
	policy = policy_strict		policy = policy_strict

	~~We’ll apply~~ policy_strict for all root CA signatures, as the root CA is only being used to create intermediate CAs.		Apply policy_strict for all root CA signatures, as the root CA is only being used to create intermediate CAs.
	[ policy_strict ]		[ policy_strict ]
	# The root CA should only sign intermediate certificates that match.		# The root CA should only sign intermediate certificates that match.
Line 62:		Line 62:
	commonName = supplied		commonName = supplied
	emailAddress = optional		emailAddress = optional
	~~We’ll apply~~ policy_loose for all intermediate CA signatures, as the intermediate CA is signing server and client certificates that may come from a variety of third-parties.
			Spply policy_loose for all intermediate CA signatures, as the intermediate CA is signing server and client certificates that may come from a variety of third-parties.
	[ policy_loose ]		[ policy_loose ]
	# Allow the intermediate CA to sign a more diverse range of certificates.		# Allow the intermediate CA to sign a more diverse range of certificates.
Line 73:		Line 74:
	commonName = supplied		commonName = supplied
	emailAddress = optional		emailAddress = optional

	Options from the [ req ] section are applied when creating certificates or certificate signing requests.		Options from the [ req ] section are applied when creating certificates or certificate signing requests.
	[ req ]		[ req ]
Line 100:		Line 102:
	#organizationalUnitName_default =		#organizationalUnitName_default =
	#emailAddress_default =		#emailAddress_default =

	The next few sections are extensions that can be applied when signing certificates. For example, passing the -extensions v3_ca command-line argument will apply the options set in [ v3_ca ].		The next few sections are extensions that can be applied when signing certificates. For example, passing the -extensions v3_ca command-line argument will apply the options set in [ v3_ca ].

	~~We’ll apply~~ the v3_ca extension when we create the root certificate.		Apply the v3_ca extension when we create the root certificate.
	[ v3_ca ]		[ v3_ca ]
	# Extensions for a typical CA (`man x509v3_config`).		# Extensions for a typical CA (`man x509v3_config`).
Line 109:		Line 112:
	basicConstraints = critical, CA:true		basicConstraints = critical, CA:true
	keyUsage = critical, digitalSignature, cRLSign, keyCertSign		keyUsage = critical, digitalSignature, cRLSign, keyCertSign
	~~We’ll apply~~ the v3_ca_intermediate extension when we create the intermediate certificate. pathlen:0 ensures that there can be no further certificate authorities below the intermediate CA.
			Apply the v3_ca_intermediate extension when we [[create the intermediate certificate]]. pathlen:0 ensures that there can be no further certificate authorities below the intermediate CA.
	[ v3_intermediate_ca ]		[ v3_intermediate_ca ]
	# Extensions for a typical intermediate CA (`man x509v3_config`).		# Extensions for a typical intermediate CA (`man x509v3_config`).
Line 126:		Line 130:
	keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment		keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
	extendedKeyUsage = clientAuth, emailProtection		extendedKeyUsage = clientAuth, emailProtection
	~~We’ll apply~~ the server_cert extension when signing server certificates, such as those used for web servers.
			Apply the server_cert extension when signing server certificates, such as those used for web servers.
	[ server_cert ]		[ server_cert ]
	# Extensions for server certificates (`man x509v3_config`).		# Extensions for server certificates (`man x509v3_config`).
Line 136:		Line 141:
	keyUsage = critical, digitalSignature, keyEncipherment		keyUsage = critical, digitalSignature, keyEncipherment
	extendedKeyUsage = serverAuth		extendedKeyUsage = serverAuth
	The crl_ext extension is automatically applied when creating certificate revocation lists.
			The crl_ext extension is automatically applied when creating [[certificate revocation lists]].
	[ crl_ext ]		[ crl_ext ]
	# Extension for CRLs (`man x509v3_config`).		# Extension for CRLs (`man x509v3_config`).
	authorityKeyIdentifier=keyid:always		authorityKeyIdentifier=keyid:always
	~~We’ll apply~~ the ocsp extension when signing the Online Certificate Status Protocol (OCSP) certificate.
			Apply the ocsp extension when signing the [[Online Certificate Status Protocol]] (OCSP) certificate.
	[ ocsp ]		[ ocsp ]
	# Extension for OCSP signing certificates (`man ocsp`).		# Extension for OCSP signing certificates (`man ocsp`).

imported>Jawadmin at 16:19, 23 December 2018

2018-12-23T16:19:53Z

← Older revision		Revision as of 11:19, 23 December 2018
Line 20:		Line 20:
	'''Prepare the configuration file'''		'''Prepare the configuration file'''

	You must create a configuration file for OpenSSL to use. Copy the root CA configuration file from the Appendix to /root/ca/openssl.cnf.		You must create a configuration file for OpenSSL to use. Copy the root CA configuration file from the [[Appendix]] to /root/ca/openssl.cnf.

	The [ ca ] section is mandatory. Here we tell OpenSSL to use the options from the [ CA_default ] section.		The [ ca ] section is mandatory. Here we tell OpenSSL to use the options from the [ CA_default ] section.

imported>Jawadmin at 16:11, 23 December 2018

2018-12-23T16:11:12Z

← Older revision		Revision as of 11:11, 23 December 2018
Line 11:		Line 11:
	Choose a directory (/root/ca) to store all keys and certificates.		Choose a directory (/root/ca) to store all keys and certificates.
	mkdir /root/ca		mkdir /root/ca

	Create the directory structure. The index.txt and serial files act as a flat file database to keep track of signed certificates.		Create the directory structure. The index.txt and serial files act as a flat file database to keep track of signed certificates.
	# cd /root/ca		# cd /root/ca
Line 24:		Line 25:
	[ ca ]		[ ca ]
	# `man ca`		# `man ca`
	default_ca = CA_default		default_ca = CA_default
	The [ CA_default ] section contains a range of defaults. Make sure you declare the directory you chose earlier (/root/ca).		The [ CA_default ] section contains a range of defaults. Make sure you declare the directory you chose earlier (/root/ca).
	[ CA_default ]		[ CA_default ]