1 ## How To 2 # To issue a certificate: 3 # 4 # 1. Generate the next certificate serial (if the file does not exist): 5 # xxd -l 8 -u -ps /dev/urandom > ./serial 6 # 2. Create the new certificate request (e.g. for foo.example.com): 7 # openssl req -config ./CA.cfg -new -subj "/CN=foo.example.com" \ 8 # -addext "subjectAltName=DNS:foo.example.com,IP:X.X.X.X" \ 9 # -newkey rsa -keyout ./certs/foo.example.com.key \ 10 # -out ./certs/foo.example.com.csr 11 # 12 # The above will generate request for an RSA-based certificate. One 13 # can issue an ECDSA-based certificate by replacing "-newkey rsa" with 14 # "-newkey ec -pkeyopt ec_paramgen_curve:secp384r1". 15 # 16 # 3. Issue the certificate: 17 # openssl ca -config ./CA.cfg -in ./certs/foo.example.com.csr \ 18 # -out ./certs/foo.example.com.pem 19 # 20 # To cleanup the internal database from expired certificates: 21 # 22 # 1. openssl ca -config ./CA.cfg -updatedb 23 # 24 # To revoke a certificate: 25 # 26 # 1. Revoke the certificate via file (e.g. for foo.example.com): 27 # openssl ca -config ./CA.cfg -revoke ./certs/foo.example.com.pem 28 # 2. Optionally remove the certificate file if you do not need it anymore: 29 # rm ./certs/foo.example.com.pem 30 # 3. Generate the certificate revocation list file: CRL (e.g. revoked.crl): 31 # openssl ca -config ./CA.cfg -gencrl > ./revoked.crl 32 # 33 # The key for CA was generated like follows 34 # openssl genrsa -out ./CA.key 3072 35 # openssl req -x509 -new -key ./CA.key -days 10950 -out ./CA.pem 36 # 37 # See also: 38 # 39 # - https://jamielinux.com/docs/openssl-certificate-authority/index.html 40 # - https://www.openssl.org/docs/man1.1.1/man1/ca.html 41 # - https://www.openssl.org/docs/man1.1.1/man1/openssl-req.html 42 # - https://security.stackexchange.com/questions/74345/provide-subjectaltname-to-openssl-directly-on-the-command-line 43 # - https://security.stackexchange.com/a/190646 - for ECDSA certificates 44 # - https://gist.github.com/Soarez/9688998 45 # - https://habr.com/ru/post/192446/ - Beware, your screen might "go Cyrillic"! 46 47 # certificate authority configuration 48 [ca] 49 default_ca = CA_default # The default ca section 50 51 [CA_default] 52 dir = . 53 new_certs_dir = $dir/newcerts # new certs dir (must be created) 54 certificate = $dir/CA.pem # The CA cert 55 private_key = $dir/private/CA.key # CA private key 56 57 serial = $dir/serial # serial number file for the next certificate 58 # Update before issuing it: 59 # xxd -l 8 -u -ps /dev/urandom > ./serial 60 database = $dir/index.txt # (must be created manually: touch ./index.txt) 61 62 default_days = 10950 # how long to certify for 63 64 #default_crl_days = 30 # the number of days before the 65 default_crl_days = 10950 # next CRL is due. That is the 66 # days from now to place in the 67 # CRL nextUpdate field. If CRL 68 # is expired, certificate 69 # verifications will fail even 70 # for otherwise valid 71 # certificates. Clients might 72 # cache the CRL, so the expiry 73 # period should normally be 74 # relatively short (default: 75 # 30) for production CAs. 76 77 default_md = sha256 # digest to use 78 79 policy = policy_default # default policy 80 email_in_dn = no # Don't add the email into cert DN 81 82 name_opt = ca_default # Subject name display option 83 cert_opt = ca_default # Certificate display option 84 85 # We need the following in order to copy Subject Alt Name(s) from a 86 # request to the certificate. 87 copy_extensions = copy # copy extensions from request 88 89 [policy_default] 90 countryName = optional 91 stateOrProvinceName = optional 92 organizationalUnitName = optional 93 commonName = supplied 94 emailAddress = optional 95 96 # default certificate requests settings 97 [req] 98 # Options for the `req` tool (`man req`). 99 default_bits = 3072 # for RSA only 100 distinguished_name = req_default 101 string_mask = utf8only 102 # SHA-1 is deprecated, so use SHA-256 instead. 103 default_md = sha256 104 # do not encrypt the private key file 105 encrypt_key = no 106 107 [req_default] 108 # See <https://en.wikipedia.org/wiki/Certificate_signing_request>. 109 countryName = Country Name (2 letter code) 110 stateOrProvinceName = State or Province Name (full name) 111 localityName = Locality Name (e.g., city) 112 0.organizationName = Organization Name (e.g., company) 113 organizationalUnitName = Organizational Unit Name (e.g. department) 114 commonName = Common Name (e.g. server FQDN or YOUR name) 115 emailAddress = Email Address 116 # defaults 117 countryName_default = UA 118 stateOrProvinceName_default = Kharkiv Oblast 119 localityName_default = Kharkiv 120 0.organizationName_default = ISC 121 organizationalUnitName_default = Software Engeneering (BIND 9) 122
Indexes created Fri Sep 18 00:27:12 UTC 2026