SecurityEngineering/x509Certs: Difference between revisions

SecurityEngineering/x509Certs (view source)

Revision as of 00:15, 5 August 2014

34 bytes removed , 5 August 2014

m

→‎Generate the end entity certificate

Kathleen Wilson

Confirmed users, Administrators

5,526

edits

@@ Line 83: / Line 83: @@
 == Generate the end entity certificate ==
-Assuming this is for www.example.com
+Update www.example.com below to match your domain.
-. Generate key <br />
+# Generate key
-:"openssl genpkey -algorithm RSA -out eekey.pem -pkeyopt rsa_keygen_bits: 2048" <br/>
+#* "openssl genpkey -algorithm RSA -out eekey.pem -pkeyopt rsa_keygen_bits: 2048"
-:A 2048 is considered secure for the next 4 years. <br/>
+#* 2048 is considered secure for the next 4 years.
-. Generate csr <br/>
+# Generate csr
-:"openssl req -new -key key.pem -days 1096 -extensions v3_ca -batch -out example.csr - utf8 -subj '/CN=www.example.com' <br/>
+#* "openssl req -new -key key.pem -days 1096 -extensions v3_ca -batch -out example.csr - utf8 -subj '/CN=www.example.com'
-:Make a new Certificate Signing Request (CSR) that will be valid for 3 years.<br/>
+#* Make a new Certificate Signing Request (CSR) that will be valid for 3 years.
-. Write extensions file (make a new file with name openssl.ss.cnf with the following contents) <br/>
+# Write extensions file (make a new file with name openssl.ss.cnf with the following contents)
-:basicConstraints = CA:FALSE<br/>
+#* basicConstraints = CA:FALSE
-:subjectAltName =DNS:www.example.com<br/>
+#* subjectAltName =DNS:www.example.com
-:extendedKeyUsage =serverAuth<br/>
+#* extendedKeyUsage =serverAuth<
-:authorityInfoAccess = OCSP;URI:http://ocsp.example.com:80/<br/>
+#* authorityInfoAccess = OCSP;URI:http://ocsp.example.com:80/
-. Intermediate sings the csr (using SHA256) and appends the extensions described in the file <br/>
+# Intermediate sings the csr (using SHA256) and appends the extensions described in the file
-:"openssl x509 -req -sha256 -days  1096 -in  example.csr -CAkey intkey.pem  -CA int.pem -set_serial  $SOME_LARGE_INTEGER -out www.example.com.pem  -extfile openssl.int.cnf"
+#* "openssl x509 -req -sha256 -days  1096 -in  example.csr -CAkey intkey.pem  -CA int.pem -set_serial  $SOME_LARGE_INTEGER -out www.example.com.pem  -extfile openssl.int.cnf"
 =Security Notes =