create custom ssl certificate

In theory it is easy to create self-signed host certificates. But in practice there are some stumbling blocks when creating certificates. This example creates a root CA by using open-oource tool openssl. This are the basic steps:

1. create certification authority certificate (root-ca)
2. create private key and sign root ca
3. create host private key
4. create host certificate
5. sign host certificate with CA

create certification authority (root ca)

We are starting with a text file named root-ca.cnf. It contains root ca configuration:

• line 2-4: set defaults
• line 5/7: distinguished name
• line 8+: country, state, city, …

As prerequisite in next step the private key is created:

The req command creates a root ca certificate signed with the private key:

Openssl subcommand is used to verify contents of previously created x509 certificate:

create host private ssl key

Create a private key for host. We used the genrsa sub command to create a private key. Repeat these steps in similar way to create a host key:

Java runtime requires pkcs8 format for proper working, so format is transformed into pkcs8 format:

create host ssl certificate

Creating host certificate with extended attributes is tricky because of an bug in openssl.

“Extensions in certificates are not transferred to certificate requests and vice versa.

It is possible to produce invalid certificates or requests by specifying the wrong private key or using inconsistent options in some cases: these should be checked.

There should be options to explicitly set such things as start and end dates rather than an offset from the current time.”

https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS

Direct transfer from root ca is not possible. So apply extended attributes when creating host certificate. Use configuration file with missing attributes:le:

Apply this configuration to certificate sign request (csr).

sign host certificate with certification authority (ca)

And finally create server certificates signed by our previously creates ca:

Use following command to show certificate contents:

conclusion

Openssl offers several ways to create self signed certificates. Use the way described in this article to create your own certificates. Adapt configuration file to your needs. Using configuration file helps to shorten command line.