OpenSSL certs with CA signing

openssl.md

Creating a CA signed cert with OpenSSL

see also

• https://gist.github.com/Soarez/9688998
• https://gist.github.com/vreemt/7070fced19b0eddbce75edfc5cbf958e
• decoder https://www.sslshopper.com/certificate-decoder.html

generating files - *.crt, *.key, *.pubkey, *.csr, *.srl

• ca.pem -- root CA
• cert.pem -- server cert

example.org: special.io

ca.crt: testme.io

Generate key and signing request for server cert

openssl genrsa -out example.org.key 2048
openssl rsa -in example.org.key -pubout -out example.org.pubkey

# server CN - special.io
openssl req -new -key example.org.key -out example.org.csr

Generate key and cert for CA

# ca CN - testme.io
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt

Generate cert via CSR and CA

openssl x509 -req -in example.org.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out example.org.crt

Check issuer and subject CN

signing crt with ca should result in a serial file (ca.srl) being created,
contents should match the (hex) serial number for the server cert

openssl x509 -in example.org.crt -noout -issuer -subject
# issuer= /C=GB/L=Default City/O=Default Company Ltd/CN=testme.io
# subject= /C=GB/L=Default City/O=Default Company Ltd/CN=special.io