Digital Certificates

Index

Digital certificates

OpenSSL is also an excellent tool for creating Certificate Authorities and generating digital certificates. In this part we will see how we can create a Certificate Authority, generate requests for digital certificates and issue those digital certificates. On most of this commands, we are going to use the openssl.cnf file. This openssl.cnf file is usually distributed with the Openssl distribution.

Create a certification authority

To create our own Certificate Authority (CA) we will create a folder structure that contains a series of CA information.

mkdir private certs newcerts crl

Next we create two files that serve as a database for storing some of CA's supporting information:

touch index.txt

echo '01' > serial

And we will create the application for the certificate itself based on a set of characteristics:

  • We will use the OpenSSL configuration file (it will come with your OpenSSL installation)

  • The output will be generated in an X.509 structure

  • We specify what a set of extensions will contain

  • We specify where the key pair and certificate will be stored

  • We specify that the certificate will be generated for a period of 5 years (1825 days)

Use this command (parts of the command, depend on the configuration present in openssl.cnf, namely the -extensions):

And then request the necessary information:

After this, the certificate will be produced.

Verify the generated digital certificate

We can check the generated (self-signed) digital certificate by viewing the X.509 structure.

This is the structure of the certificate:

Generate a digital certificate request

Let's now start operating the CA as if it were a real CA. One of the important steps is that when someone tries to request a certificate from a CA they need to create a Certificate Signing Request (CSR). So we are going to create that.

In this specific case we chose not to protect the private key with a password (-nodes), which is not recommended in a production environment. On the other hand, the request will be made for one year (365 days).

Then supply the request information:

We can verify the request using the following command:

Check the request that is about to be made:

Before issuing the certificate (signing it with its own private key), a CA must check the contents of the CSR.

Issuance of the digital certificate

This step is important because it is performed by a CA to issue a digital certificate to an entity that requests it. To generate this digital certificate, the previously generated CSR must be used.

This is the issuance process:

To confirm that the certificate was issued correctly, we can view it using the command we saw earlier:

And look at the certificate data:

This book in this link also contains detailed instructions on how to create your own private CA.

Revocation of digital certificates

One of the functions of a CA is also to maintain information about the digital certificates it issues. Whenever a certificate, for whatever reason, is no longer valid, it must be revoked. One of the ways to revoke and communicate this revocation to "third parties" is through a Certificate Revocation List (CRL).

To revoke a certificate, using OpenSSl, we can do the following:

And the proper certificate gets revoked:

The certificate is thus revoked and to switch to the CRL the following must be done:

To view the certificates that are part of the CRL, we can do the following:

Look at the revocationlist of the CA:

PreviousDigital SignaturesNextS/MIME

Last updated