In a previous post I talked about using SSL in a development environment and how to generate self signed root certificates that you can install on clients and servers to allow for trusted communication between systems.
Instead of using a root certificate for you application; this post explains why it is better to create a certificate chain containing.
Generate a self signed root ssl certificate
First generate a root certificate. This certificate will be used to sign other certificates.
# When asked for Common Name fill in something # like 'My Dev Certificate Authority' $ openssl req -new -x509 -extensions v3_ca -keyout ca.key \ -out ca.crt -days 3650
You will have to answer some questions and hit enter a few times. If
succesfull you will now have two files; a
ca.key containing the private key
that is encrypted using the passphrase you entered and
ca.crt containing the
public key of this root certificate.
Keep the private key in a very safe place. You will not install this file anywhere. You will only need it to sign subsequent certificates.
Because we are creating self signed certificates every client needs to manually trust the root certificate. You do this by installing/importing the .crt version of this certificate. How to import a certificate depends where you want to import it. On Windows based systems you use the MMC tool. On Mac OSX you can double click on the .crt file to import it into your keychain. For unix based systems see my previous posts on ssl certificates here.
Once a client trusts this root certificate, it will automatically trust every other certificate that was signed using this root certificate.
Generate a ssl certificate for your application
Let’s assume you are working on an application
myapp.example.com and you
need to have it available over SSL. We will create a certificate for the
myapp.example.com and we will sign it using the previously
created root ssl certificate.
Since you already installed this root certificate on your clients (e.g. your
iphone mac, windows pc at work) you can immediatly start browsing your
application without getting those nasty red warning messages in your browser.
First create a private key for this certificate (you will need this later when you setup apache/nginx or whatever you use)
$ openssl genrsa -out certificate.key 1024
Now create a certificate signing request using the generated private key
$ openssl req -new -key certificate.key -out certificate.csr
The last step is important; now you will need to create the public certificate
using the root certificate from step (1).
The certificate for
myapp.example.com is created using the signing request
certificate.scr, the certificate of the root Certificate Authority
ca.crt and the private key of the root Certificate Authority
$ openssl x509 -req -days 365 -in certificate.csr -CA ca.crt \ -CAkey ca.key -set_serial 01 -out certificate.crt $ rm certificate.csr
When you are done with this step you can remove the signing request file.
That’s it. Now you have a
certificate.key and a
certificate.crt file, and
together with the certificate of the Central Authority
ca.crt you are able
to setup SSL in e.g. apache or nginx.
See Certificate chain of a website
Use the following command to see all the Certificates:
$ openssl s_client -showcerts \ -connect example.org:443 < /dev/null 2> /dev/null | \ sed -n '/BEGIN/,/END/p'