"OpenSSL" Acting as a CA (Certificate Authority)

Cryptography Tutorials - Herong's Tutorial Examples

∟"OpenSSL" Signing CSR Generated by "keytool"

∟"OpenSSL" Acting as a CA (Certificate Authority)

This section provides a tutorial example on how to prepare OpenSSL to be used as CA (Certificate Authority) to sign other people's CSR (Certificate Signing Request).

If I want to act as a CA (Certificate Authority), I must have a tool to sign other people's CSR (Certificate Signing Request). As we learned from previous chapters, "keytool" can not sign CSR. So I must use "OpenSSL" to act as a CA.

Here is a list of things I need to do with "OpenSSL" as a CA:

Install "OpenSSL" installed properly and create configuration file, openssl.cnf.
Created a CA private key file with 2048-bit keys, and protect it with a password.
Self-sign my CA public key certificate, which can be given out to anyone.

Let's check the "OpenSSL" installation first. If "OpenSSL" was installed at \local\GnuWin32\, the following command should report back the version number:

C:\herong>\local\gnuwin32\bin\openssl version

OpenSSL 0.9.7c 30 Sep 2003

C:\herong>set path=<old_path>;\local\gnuwin32\bin\

To save typing time, I added \local\gnuwin32\bin\ to the PATH environment variable as shown above.

Then look at the configuration file, openssl.cnf, which is needed only when I self-signing my CA public certificate. I can use the openssl.cnf as is without any changes. But if I want to put in my CA distinguished name information to save time when self-signing my CA public certificate, I can add these settings to openssl.cnf:

countryName_default             = CA
stateOrProvinceName_default     = HY State
localityName_default            = HY City
0.organizationName_default      = HY Company
organizationalUnitName_default  = HY Unit 
commonName_default              = Herong Yang
emailAddress_default            = herongyang.com