Openssl - Revision history

Tim: /* creating a certificate signing authority ca (and cert and key) */

2017-02-09T17:52:14Z

creating a certificate signing authority ca (and cert and key)

← Older revision		Revision as of 13:52, 9 February 2017
Line 79:		Line 79:
	openssl ca -config intermediate/openssl.conf -extensions server_cert -days 9000 -notext -md sha256 -in intermediate/csr/sslvh.tm.csr.pem -out intermediate/certs/sslvh.tm.cert.pem		openssl ca -config intermediate/openssl.conf -extensions server_cert -days 9000 -notext -md sha256 -in intermediate/csr/sslvh.tm.csr.pem -out intermediate/certs/sslvh.tm.cert.pem
	openssl x509 -noout -text -in intermediate/certs/sslvh.tm.cert.pem		openssl x509 -noout -text -in intermediate/certs/sslvh.tm.cert.pem
			openssl x509 -text -noout -in sslvh.tm.cert.pem -fingerprint

	The Issuer is the intermediate CA. The Subject refers to the certificate itself.		The Issuer is the intermediate CA. The Subject refers to the certificate itself.

Tim: /* creating a certificate signing authority ca */

2017-02-03T20:25:27Z

creating a certificate signing authority ca

← Older revision		Revision as of 16:25, 3 February 2017
Line 49:		Line 49:
	:your ca file will be chain.pem or fullchain.pem ( depending exactly what you need )		:your ca file will be chain.pem or fullchain.pem ( depending exactly what you need )

	====creating a certificate signing authority ca====		====creating a certificate signing authority ca (and cert and key)====
	https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html		https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html

Tim at 19:43, 3 February 2017

2017-02-03T19:43:33Z

← Older revision		Revision as of 15:43, 3 February 2017
Line 85:		Line 85:
	You can now either deploy your new certificate to a server, or distribute the certificate to a client. When deploying to a server application (eg, Apache), you need to make the following files available:		You can now either deploy your new certificate to a server, or distribute the certificate to a client. When deploying to a server application (eg, Apache), you need to make the following files available:

	:ca-chain.cert.pem		:C:\wamp\vhosts\somecerts\caSetup\intermediate\certs\ca-chain.cert.pem
	:sslvh.tm.key.pem		:C:\wamp\vhosts\somecerts\caSetup\intermediate\private\sslvh.tm.key.pem
	:sslvh.tm.cert.pem		:C:\wamp\vhosts\somecerts\caSetup\intermediate\certs\sslvh.tm.cert.pem

	you could but I didn't create a certifice revocation lis CRL		you could but I didn't create a certifice revocation lis CRL

Tim at 19:41, 3 February 2017

2017-02-03T19:41:14Z

← Older revision		Revision as of 15:41, 3 February 2017
Line 85:		Line 85:
	You can now either deploy your new certificate to a server, or distribute the certificate to a client. When deploying to a server application (eg, Apache), you need to make the following files available:		You can now either deploy your new certificate to a server, or distribute the certificate to a client. When deploying to a server application (eg, Apache), you need to make the following files available:

	ca-chain.cert.pem		:ca-chain.cert.pem
	sslvh.tm.key.pem		:sslvh.tm.key.pem
	sslvh.tm.cert.pem		:sslvh.tm.cert.pem

	you could but I didn't create a certifice revocation lis CRL		you could but I didn't create a certifice revocation lis CRL

Tim at 18:37, 3 February 2017

2017-02-03T18:37:50Z

← Older revision		Revision as of 14:37, 3 February 2017
Line 79:		Line 79:
	openssl ca -config intermediate/openssl.conf -extensions server_cert -days 9000 -notext -md sha256 -in intermediate/csr/sslvh.tm.csr.pem -out intermediate/certs/sslvh.tm.cert.pem		openssl ca -config intermediate/openssl.conf -extensions server_cert -days 9000 -notext -md sha256 -in intermediate/csr/sslvh.tm.csr.pem -out intermediate/certs/sslvh.tm.cert.pem
	openssl x509 -noout -text -in intermediate/certs/sslvh.tm.cert.pem		openssl x509 -noout -text -in intermediate/certs/sslvh.tm.cert.pem

			The Issuer is the intermediate CA. The Subject refers to the certificate itself.
			openssl verify -CAfile intermediate/certs/ca-chain.cert.pem intermediate/certs/sslvh.tm.cert.pem

			You can now either deploy your new certificate to a server, or distribute the certificate to a client. When deploying to a server application (eg, Apache), you need to make the following files available:

			ca-chain.cert.pem
			sslvh.tm.key.pem
			sslvh.tm.cert.pem

			you could but I didn't create a certifice revocation lis CRL

Tim at 18:30, 3 February 2017

2017-02-03T18:30:34Z

← Older revision		Revision as of 14:30, 3 February 2017
Line 56:		Line 56:
	in C:\wamp\vhosts\somecerts\caSetup		in C:\wamp\vhosts\somecerts\caSetup
	create root certificates		create root certificates
			mkdir certs crl csr newcerts private
			touch index.txt
			echo 1000 > serial
	put in a openssl.conf		put in a openssl.conf
	openssl genrsa -aes256 -out private/ca.key.pem 4096 //pwd required		openssl genrsa -aes256 -out private/ca.key.pem 4096 //pwd required
Line 63:		Line 66:
	cd intermediate		cd intermediate
	mkdir certs crl csr newcerts private		mkdir certs crl csr newcerts private
	~~chmod 700 private~~
	touch index.txt		touch index.txt
	echo 1000 > serial		echo 1000 > serial
Line 70:		Line 72:
	openssl req -config intermediate/openssl.conf -new -sha256 -key intermediate/private/intermediate.key.pem -out intermediate/csr/intermediate.csr.pem		openssl req -config intermediate/openssl.conf -new -sha256 -key intermediate/private/intermediate.key.pem -out intermediate/csr/intermediate.csr.pem
	openssl ca -config openssl.conf -extensions v3_intermediate_ca -days 10900 -notext -md sha256 -in intermediate/csr/intermediate.csr.pem -out intermediate/certs/intermediate.cert.pem		openssl ca -config openssl.conf -extensions v3_intermediate_ca -days 10900 -notext -md sha256 -in intermediate/csr/intermediate.csr.pem -out intermediate/certs/intermediate.cert.pem
	openssl x509 -noout -text -in intermediate/certs/intermediate.cert.pem		openssl x509 -noout -text -in intermediate/certs/intermediate.cert.pem //verify
			openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate.cert.pem //verify against root
			cat intermediate/certs/intermediate.cert.pem certs/ca.cert.pem > intermediate/certs/ca-chain.cert.pem
			openssl genrsa -out intermediate/private/sslvh.tm.key.pem 2048 //omitting aes256 creates a key without a password
			openssl req -config intermediate/openssl.conf -key intermediate/private/sslvh.tm.key.pem -new -sha256 -out intermediate/csr/sslvh.tm.csr.pem
			openssl ca -config intermediate/openssl.conf -extensions server_cert -days 9000 -notext -md sha256 -in intermediate/csr/sslvh.tm.csr.pem -out intermediate/certs/sslvh.tm.cert.pem
			openssl x509 -noout -text -in intermediate/certs/sslvh.tm.cert.pem

Tim: /* openssl */

2017-02-03T17:56:27Z

openssl

← Older revision		Revision as of 13:56, 3 February 2017
Line 55:		Line 55:

	in C:\wamp\vhosts\somecerts\caSetup		in C:\wamp\vhosts\somecerts\caSetup
			create root certificates
	put in a openssl.conf		put in a openssl.conf
	openssl genrsa -aes256 -out private/ca.key.pem 4096 //pwd required		openssl genrsa -aes256 -out private/ca.key.pem 4096 //pwd required
	openssl req -config openssl.conf -key private/ca.key.pem -new -x509 -days 12000 -sha256 -~~extensi ons~~ v3_ca -out certs/ca.cert.pem		openssl req -config openssl.conf -key private/ca.key.pem -new -x509 -days 12000 -sha256 -extensions v3_ca -out certs/ca.cert.pem //need privar pwd and Common Name hpTimCa
			openssl x509 -noout -text -in certs/ca.cert.pem //verify root cert
			create intermediate certs
			cd intermediate
			mkdir certs crl csr newcerts private
			chmod 700 private
			touch index.txt
			echo 1000 > serial
			echo 1000 > crlnumber
			openssl genrsa -aes256 -out intermediate/private/intermediate.key.pem 4096 //same pwd
			openssl req -config intermediate/openssl.conf -new -sha256 -key intermediate/private/intermediate.key.pem -out intermediate/csr/intermediate.csr.pem
			openssl ca -config openssl.conf -extensions v3_intermediate_ca -days 10900 -notext -md sha256 -in intermediate/csr/intermediate.csr.pem -out intermediate/certs/intermediate.cert.pem
			openssl x509 -noout -text -in intermediate/certs/intermediate.cert.pem

Tim: /* openssl */

2017-02-03T17:26:58Z

openssl

← Older revision		Revision as of 13:26, 3 February 2017
Line 51:		Line 51:
	====creating a certificate signing authority ca====		====creating a certificate signing authority ca====
	https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html		https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html

			Acting as a certificate authority (CA) means dealing with cryptographic pairs of private keys and public certificates. The very first cryptographic pair we’ll create is the root pair. This consists of the root key (ca.key.pem) and root certificate (ca.cert.pem). This pair forms the identity of your CA.

			in C:\wamp\vhosts\somecerts\caSetup

			put in a openssl.conf
			openssl genrsa -aes256 -out private/ca.key.pem 4096 //pwd required
			openssl req -config openssl.conf -key private/ca.key.pem -new -x509 -days 12000 -sha256 -extensi ons v3_ca -out certs/ca.cert.pem

Tim: /* openssl */

2017-02-03T17:08:01Z

openssl

← Older revision		Revision as of 13:08, 3 February 2017
Line 48:		Line 48:
	:your cert file will be cert.pem		:your cert file will be cert.pem
	:your ca file will be chain.pem or fullchain.pem ( depending exactly what you need )		:your ca file will be chain.pem or fullchain.pem ( depending exactly what you need )

			====creating a certificate signing authority ca====
			https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html

Tim: /* openssl */

2017-02-03T17:07:15Z

openssl

← Older revision		Revision as of 13:07, 3 February 2017
Line 1:		Line 1:
	==== openssl ====		=== openssl ===

	back to [[esp8266]]		back to [[esp8266]]