Giter Site home page Giter Site logo

ca_scratchpad's Introduction

Create Root CA Key and cert

This repo is just a simple template to create a self-issued CA and Subordinate CA to issue TLS certificates.

The cross_sign/ folder contains instruction to create two CAs and Subordinate CAs where one is cross signed

$ tree
.
├── ca            // CA details stored here
├── certs         // issued certs stored here
├── client.conf   // config for the client certs 
├── crl           // CRLs are stored here
├── LICENSE
├── README.md
├── root-ca.conf  // config for the root ca
├── server.conf   // config for the server certs 
└── tls-ca.conf   // config for the subordinate ca

This will generate a root CA, crls, subordinate CA and then using the subordinate, any number of client and server certs.

If you just want leaf certs issued directly from the root, see the section at the end

For starters, we'll just crate a single root CA:

Single Level CA

The following will issue certificates directly from the root

mkdir -p ca/root-ca/private ca/root-ca/db crl certs
chmod 700 ca/root-ca/private
cp /dev/null ca/root-ca/db/root-ca.db
cp /dev/null ca/root-ca/db/root-ca.db.attr

echo 01 > ca/root-ca/db/root-ca.crt.srl
echo 01 > ca/root-ca/db/root-ca.crl.srl

# Pick signature algo (either do A,B or C)

# A) Signature Algorithm: sha256WithRSAEncryption
    openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out ca/root-ca/private/root-ca.key

# B) Signature Algorithm: rsassaPss
    openssl genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out ca/root-ca/private/root-ca.key

# C) Signature Algorithm: ecdsa-with-SHA256
    openssl genpkey -algorithm ec -pkeyopt  ec_paramgen_curve:P-256 \
      -pkeyopt ec_param_enc:named_curve -pkeyopt ec_paramgen_curve:secp384r1 \
      -out ca/root-ca/private/root-ca.key
   
openssl req -new  -config single-root-ca.conf  -key ca/root-ca/private/root-ca.key \
   -out ca/root-ca.csr  

openssl ca -selfsign     -config single-root-ca.conf  \
   -in ca/root-ca.csr     -out ca/root-ca.crt  \
   -extensions root_ca_ext
  • Issue server
export NAME=server

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out certs/$NAME.key

openssl req -new     -config server.conf \
  -out certs/$NAME.csr  \
  -key certs/$NAME.key \
  -subj "/C=US/O=Google/OU=Enterprise/CN=server.domain.com" 

## to specify a SAN, edit single-root-ca.conf and modify [ alt_names ]

openssl ca \
    -config single-root-ca.conf \
    -in certs/$NAME.csr \
    -out certs/$NAME.crt  \
    -extensions server_ext
  • Issue client
export NAME=user10

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out certs/$NAME.key

openssl req -new \
    -config client.conf \
    -out certs/$NAME.csr \
    -key certs/$NAME.key \
    -subj "/L=US/O=Google/OU=Enterprise/CN=user10.domain.com"

## to specify a SAN, edit single-root0ca.conf and modify [ alt_names ]

openssl ca \
    -config single-root-ca.conf \
    -in certs/$NAME.csr \
    -out certs/$NAME.crt \
    -policy extern_pol \
    -extensions client_ext

note, for ECC keys, its something like this:

openssl genpkey -algorithm ec -pkeyopt  ec_paramgen_curve:P-256 \
      -pkeyopt ec_param_enc:named_curve \
      -out certs/$NAME.key

openssl req -new     -config server.conf \
  -out certs/$NAME.csr   \
  -key certs/$NAME.key \
  -subj "/C=US/O=Google/OU=Enterprise/CN=server.domain.com"

openssl ca \
    -config single-root-ca.conf \
    -in certs/$NAME.csr \
    -out certs/$NAME.crt \
    -extensions server_ext

Create Root CA

Create a root CA and subordinate

mkdir -p ca/root-ca/private ca/root-ca/db crl certs
chmod 700 ca/root-ca/private
cp /dev/null ca/root-ca/db/root-ca.db
cp /dev/null ca/root-ca/db/root-ca.db.attr

echo 01 > ca/root-ca/db/root-ca.crt.srl
echo 01 > ca/root-ca/db/root-ca.crl.srl

# Pick signature algo (either do A,B or C)

# A) Signature Algorithm: sha256WithRSAEncryption
    openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out ca/root-ca/private/root-ca.key

# B) Signature Algorithm: rsassaPss
    openssl genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out ca/root-ca/private/root-ca.key

# C) Signature Algorithm: ecdsa-with-SHA256
    openssl genpkey -algorithm ec -pkeyopt  ec_paramgen_curve:P-256 \
      -pkeyopt ec_param_enc:named_curve -pkeyopt ec_paramgen_curve:secp384r1 \
      -out ca/root-ca/private/root-ca.key
   
openssl req -new  -config root-ca.conf  -key ca/root-ca/private/root-ca.key \
   -out ca/root-ca.csr  

openssl ca -selfsign     -config root-ca.conf  \
   -in ca/root-ca.csr     -out ca/root-ca.crt  \
   -extensions root_ca_ext

openssl x509 -in ca/root-ca.crt -text -noout

Gen CRL

Optionally create a CRL

mkdir crl/

openssl ca -gencrl     -config root-ca.conf     -out crl/root-ca.crl

openssl crl -in crl/root-ca.crl -noout -text

Create Subordinate CA for TLS Signing

This is the CA that will issue the client and server certs

mkdir -p ca/tls-ca/private ca/tls-ca/db crl certs
chmod 700 ca/tls-ca/private

cp /dev/null ca/tls-ca/db/tls-ca.db
cp /dev/null ca/tls-ca/db/tls-ca.db.attr
echo 01 > ca/tls-ca/db/tls-ca.crt.srl
echo 01 > ca/tls-ca/db/tls-ca.crl.srl

# Pick signature algo (either do A,B or C)

# A) Signature Algorithm: sha256WithRSAEncryption
    openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out ca/tls-ca/private/tls-ca.key

# B) Signature Algorithm: rsassaPss
    openssl genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out ca/tls-ca/private/tls-ca.key

# C) Signature Algorithm: ecdsa-with-SHA256
    openssl genpkey -algorithm ec -pkeyopt  ec_paramgen_curve:P-256 \
      -pkeyopt ec_param_enc:named_curve -pkeyopt ec_paramgen_curve:secp384r1 \
      -out ca/tls-ca/private/tls-ca.key
   

openssl req -new  -config tls-ca.conf -key ca/tls-ca/private/tls-ca.key \
   -out ca/tls-ca.csr

openssl ca \
    -config root-ca.conf \
    -in ca/tls-ca.csr \
    -out ca/tls-ca.crt \
    -extensions signing_ca_ext


openssl ca -gencrl \
    -config tls-ca.conf \
    -out crl/tls-ca.crl
  • Combine the Root and subordinate CA into a chain:
cat ca/tls-ca.crt ca/root-ca.crt >  ca/tls-ca-chain.pem

Generate Server Cert (TLS)

Set env vars for the server cert

NAME: filename to use for the cert/key/csr SAN: SAN Value

edit the CN value below (eg to the same SAN Value)

export NAME=server

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out certs/$NAME.key

openssl req -new     -config server.conf \
  -out certs/$NAME.csr   \
  -key certs/$NAME.key \
  -subj "/C=US/O=Google/OU=Enterprise/CN=server.domain.com"

## to specify a SAN, edit tls-caa.conf and modify [ alt_names ]

openssl ca \
    -config tls-ca.conf \
    -in certs/$NAME.csr \
    -out certs/$NAME.crt \
    -extensions server_ext

Generate Client Certificate

Generate client certificate

export NAME=user

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out certs/$NAME.key


openssl req -new \
    -config client.conf \
    -out certs/$NAME.csr \
    -key certs/$NAME.key \
    -subj "/C=US/O=Google/OU=Enterprise/[email protected]"

## to specify a SAN, edit tls-caa.conf and modify [ alt_names ]

openssl ca \
    -config tls-ca.conf \
    -in certs/$NAME.csr \
    -out certs/$NAME.crt \
    -policy extern_pol \
    -extensions client_ext

Revoke a certificate

If you want to revoke a certificate certs/$NAME.crt, run

openssl ca -config tls-ca.conf   -revoke certs/$NAME.crt

and then regenerate the CRL

you'll end up with

$ tree
.
├── ca
│   ├── root-ca
│   │   ├── 01.pem
│   │   ├── 02.pem
│   │   ├── db
│   │   │   ├── root-ca.crl.srl
│   │   │   ├── root-ca.crl.srl.old
│   │   │   ├── root-ca.crt.srl
│   │   │   ├── root-ca.crt.srl.old
│   │   │   ├── root-ca.db
│   │   │   ├── root-ca.db.attr
│   │   │   ├── root-ca.db.attr.old
│   │   │   └── root-ca.db.old
│   │   └── private
│   │       └── root-ca.key                // root CA key
│   ├── root-ca.crt                        // root CA cert
│   ├── root-ca.csr
│   ├── tls-ca
│   │   ├── 01.pem
│   │   ├── 02.pem
│   │   ├── db
│   │   │   ├── tls-ca.crl.srl
│   │   │   ├── tls-ca.crl.srl.old
│   │   │   ├── tls-ca.crt.srl
│   │   │   ├── tls-ca.crt.srl.old
│   │   │   ├── tls-ca.db
│   │   │   ├── tls-ca.db.attr
│   │   │   ├── tls-ca.db.attr.old
│   │   │   └── tls-ca.db.old
│   │   └── private
│   │       └── tls-ca.key                // subordinate CA key
│   ├── tls-ca-chain.pem
│   ├── tls-ca.crt                        // subordinate CA cert
│   └── tls-ca.csr
├── certs
│   ├── server.crt                        // issued server cert by tls-ca
│   ├── server.csr 
│   ├── server.key                        // issued server key by tls-ca
│   ├── tokenclient.crt                   // client cert
│   ├── tokenclient.csr
│   └── tokenclient.key                   // client key
├── client.conf
├── crl                                   // CRL file
│   ├── root-ca.crl
│   └── tls-ca.crl
├── LICENSE
├── README.md
├── root-ca.conf
├── server.conf
└── tls-ca.conf

TPM based private key

If you have openssl and want to issue a cert on the TPM,

also see sa_pki.sh

using openssl3 tpm2-openssl installed:

openssl version
   OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)

export NAME=tpms

openssl genpkey -provider tpm2 -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
      -pkeyopt rsa_keygen_pubexp:65537 -out certs/$NAME.key

openssl req -new  -provider tpm2 -provider default \
      -config server.conf   -out certs/$NAME.csr \
          -key certs/$NAME.key   -subj "/C=US/O=Google/OU=Enterprise/CN=server.domain.com"

openssl ca \
    -config single-root-ca.conf  \
    -in certs/$NAME.csr \
    -out certs/$NAME.crt \
    -extensions server_ext

openssl  x509 -pubkey -noout -in certs/$NAME.crt

openssl rsa  -provider tpm2 -provider default -in certs/$NAME.key -pubout

ca_scratchpad's People

Contributors

salrashid123 avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar

Forkers

edwardt imanassypov sinjap arthurvardevanyan xserveraws

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.