wgoulet / easyopensslca Goto Github PK

EasyOpenSSLCA

A dead simple command line CA using openssl and make.

This project leverages the bootstrap CA that is bundled with FreeRADIUS.
For now, it just generates a very basic PKI heirarchy 
(root CA + subCA for issuing client certs). In the future, it will be
expanded to add support for different heirarchies, cross certs for
bridge CAs, and possible MofN support for root CA private key
protection.

To create issuing certs, simply type:
make all SKI=<hash value to use as SKI>

To use the configuration file contents to create a hash for the SKI, use this command:
make all SKI=`sha256sum subca.cnf | awk '{print $1}'`

This will generate the root CA cert (cert.pem) along with it's private 
key (protected with password from ca.cnf) as well as a subCA cert
(subca.pem) and it's private key.

To make a tls server certificate, type
make client SUBJECT=<subject to include in server certificate's CN and SAN extension>

There are other targets, right now only 'make all', 'make index.txt',
'make serial', 'make ca', 'make client' and 'make subca' work. 

It's best to just use make all.

If you want to clean up everything, use 'make destroycerts'.

Prerequisites:
make
openssl (any version will do)

test