Creating a Certificate Path with OpenSSL

Cryptography Tutorials - Herong's Tutorial Examples

∟Creating a Certificate Path with OpenSSL

This section provides a tutorial example on how to create multiple certificates to form a certificate path for testing purpose.

Here is a testing scenario I followed to generate some certificates with different issuers and subjects. See previous notes if you have trouble generating keys and signing certificates.

1. Generating a self-signed certificate for Herong, herong.crt:

herong> echo Generating keys for Herong
herong> openssl genrsa -des3 -out herong_rsa.key
...

herong> echo Generating a self-signed certificate for Herong
herong> openssl req -new -key herong_rsa.key -x509 -out herong.crt 
   -config openssl.cnf
...

2. Generating a certificate for John and signed by Herong, john.crt:

herong> echo Generating keys for John
herong> openssl genrsa -des3 -out john_rsa.key
...

herong> echo Generating a certificate signing request for John
herong> openssl req -new -key john_rsa.key -out john.csr \
   -config openssl.cnf
...

herong> echo Signing a John's request by Herong's key
herong> openssl x509 -req -in john.csr -CA herong.crt \
   -CAkey herong_rsa.key -out john.crt -set_serial 3
...

3. Generating a certificate for Bill and signed by John, bill.crt:

herong> echo Generating keys for Bill
herong> openssl genrsa -des3 -out bill_rsa.key
...

herong> echo Generating a certificate signing request for Bill
herong> openssl req -new -key bill_rsa.key -out bill.csr \
   -config openssl.cnf
...

herong> echo Signing a Bill's request by John's key
herong> openssl x509 -req -in bill.csr -CA john.crt \
   -CAkey john_rsa.key -out bill.crt -set_serial 7
...

4. Generating a certificate for Tom and signed by Bill, tom.crt:

herong> echo Generating keys for Tom
herong> openssl genrsa -des3 -out tom_rsa.key
...

herong> echo Generating a certificate signing request for Bill
herong> openssl req -new -key tom_rsa.key -out tom.csr \
   -config openssl.cnf
...

herong> echo Signing a Tom's request by Bill's key
herong> openssl x509 -req -in tom.csr -CA bill.crt \
   -CAkey bill_rsa.key -out tom.crt -set_serial 11
...