Title: Create a Certificate Authority
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

Create a Certificate Authority

All that is needed to create a certificate authority is the openssl program and a place to store the files.  Since some of the files are private keys, it is best to store these files on a system which is not hosting services to the Internet.

- Start by ensuring that the latest version of openssl is installed.

yum install openssl

- Choose a name for the directory for the new CA, for example "my_ca".  Then create the required files.

mkdir -p /etc/pki/tls/my_ca
cd /etc/pki/tls/my_ca
mkdir certs crl csrs newcert private
chmod go-rwx private
echo -n > index.txt
echo 01 > serial
echo 01 > crlnumber

- Find the location of the default openssl.cfg file and make a copy of it.

openssl ca 2>&1 | grep Using
cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.orig

- Edit the default options in the openssl.cnf file.  Here are some common options to update.

HOME            = /etc/pki/tls/my_ca
dir             = $HOME
default_days    = 7305
default_bits    = 2048
policy          = policy_anything
countryName_default             = US
stateOrProvinceName_default     = Michigan
localityName_default            = Ann Arbor
0.organizationName_default      = my_site
organizationalUnitName_default  = Internet Security
commonName_default              = www.mysite.com
emailAddress_default            = me@mysite.com
nsComment   (twice)             = "Certificate issued by mysite.com"
in [req] add:
req_extensions    =v3_req
in [v3_req] add:
subjectAltName  = @alt_names
below [v3_req] add:
[alt_names]
#DNS.1 = *.mysite.com
#DNS.2 = mysite.com
#IP.1 = 1.2.3.4

The following commands will create the key file and CA certificate file.  Note that you will be prompted for a Common Name and a passphrase.  The common name may be any short string that describes your organization, for example "my_ca Certificate Authority".  This will be the name clients see when they view your CA certificate.  Be sure to remember the passphrase, since it will be required whenever certificates are managed.

openssl req -new -x509 -extensions v3_ca -keyout private/my_ca-key.pem \
-out my_ca-cert.pem -days 14610
openssl x509 -in my_ca-cert.pem -outform DER -out my_ca-cert.der

The my_ca-key.pem file is a secret file which should not be shared.  The my_ca-cert.pem is the certificate for the CA which can be shared publicly.  Any clients would need to import this file and save it as a "Certificate Authority".  If a client needs the file in DER format, share the my_ca-cert.der file.