Signing a CSR into a Certificate

This section provides a tutorial example on how to sign a CSR (Certificate Sign Request) into a certificate using OpenSSL 'x509' command.

This time, I am truly ready to sign Amy's CSR into a personal certificate using the OpenSSL "x509" command:

C:\herong>\local\gnuwin32\bin\openssl x509 -req -in amy_xyz_com.csr 
   -CAkey herong_key.pem -CA herongyang_com.crt -out amy_xyz_com.crt 
   -days 365 -set_serial 123

Loading 'screen' into random state - done
Signature ok
Getting CA Private Key
Enter pass phrase for herong_key.pem: HerongKey

I think Amy's certificate is ready:

C:\herong>type amy_xyz_com.crt


To view what's in Amy's certificate:

C:\herong>\local\gnuwin32\bin\openssl x509 -in amy_xyz_com.crt -noout 

    Version: 1 (0x0)
    Serial Number: 123 (0x7b)
    Signature Algorithm: dsaWithSHA1
    Subject: C=Unknown, ST=Unknown, L=Unknown, O=Unknown, OU=Unknown,
    Subject Public Key Info:
      Public Key Algorithm: dsaEncryption
      DSA Public Key:
  Signature Algorithm: dsaWithSHA1

What's next is to send Amy's certificate to I should also send her my certificate and certificate, so that certificate can be validated in a certificate chain.

Congratulations, we have successfully completed all steps of issuing a Class 1 personal certificate to!

Last update: 2011.

Table of Contents

 About This Book

 Introduction of PKI (Public Key Infrastructure)

 Introduction of HTTPS (Hypertext Transfer Protocol Secure)

 Using HTTPS with Google Chrome

 Using HTTPS with Mozilla Firefox

 HTTPS with IE (Internet Explorer)

 Perl Scripts Communicating with HTTPS Servers

 PHP Scripts Communicating with HTTPS Servers

 Java Programs Communicating with HTTPS Servers

 Windows Certificate Stores and Console

 .NET Programs Communicating with HTTPS Servers - Root CA Offering Free Certificates

PKI CA Administration - Issuing Certificates

 Root CA and Intermediate CA

 Requesting and Signing Personal Certificate

 Generating a Private-Public Key Pair for Amy

 Generating a CSR (Certificate Signing Request)

 Verifying Requester's Email Address

 Exporting a Private Key from a KeyStore File

Signing a CSR into a Certificate

 Importing Certificate Reply Back to KeyStore

 "bad decrypt:./crypto/evp/evp_enc.c:461" Error

 Requesting and Signing Server Certificate

 Comodo Free Personal Certificate

 Digital Signature - Microsoft Word

 Digital Signature - 3

 S/MIME and Email Security

 PKI (Public Key Infrastructure) Terminology

 Outdated Tutorials


 Full Version in PDF/EPUB