How to create SSL CA Cert Server - Revision history

24.84.196.44: /* Notes: */

2016-03-05T09:13:56Z

‎Notes:

2016-03-04T21:10:19Z

2016-03-04T06:01:25Z

2016-03-04T02:04:54Z

2016-03-04T02:02:41Z

2016-03-03T23:10:57Z

‎Testing

2016-03-03T23:10:15Z

‎Testing

2016-03-03T23:09:06Z

2016-03-03T22:56:30Z

2016-03-03T22:51:10Z

←Older revision		Revision as of 09:13, 5 March 2016
Line 49:		Line 49:
	Dovecot:		Dovecot:
	openssl req -new -x509 -days 1000 -nodes -out "/etc/ssl/certs/dovecot.pem" -keyout "/etc/ssl/private/dovecot.pem"		openssl req -new -x509 -days 1000 -nodes -out "/etc/ssl/certs/dovecot.pem" -keyout "/etc/ssl/private/dovecot.pem"
		+
		+	Dovecot self generated keys:
		+	/usr/libexec/dovecot/mkcert.sh

@@ Line 2: / Line 2: @@
 *[http://superuser.com/questions/126121/how-to-create-my-own-certificate-chain/418429 Generate SSl Chain]
 *[https://www.madboa.com/geek/openssl/ OpeenSSL Commandline Guide]
 OpenSSL needs to have a CA directory created in order to sign crt requests. Use the following steps to create a CA server, then generate/sign keys:

←Older revision		Revision as of 06:01, 4 March 2016
Line 42:		Line 42:

	If your openssl isn't set up to automatically use an installed set of root certificates (e.g. in /etc/ssl/certs), then you can use -CApath or -CAfile to specify the CA.		If your openssl isn't set up to automatically use an installed set of root certificates (e.g. in /etc/ssl/certs), then you can use -CApath or -CAfile to specify the CA.
		+
		+
		+	== Notes: ==
		+
		+	Dovecot:
		+	openssl req -new -x509 -days 1000 -nodes -out "/etc/ssl/certs/dovecot.pem" -keyout "/etc/ssl/private/dovecot.pem"

@@ Line 1: / Line 1: @@
 OpenSSL needs to have a CA directory created in order to sign crt requests. Use the following steps to create a CA server, then generate/sign keys:
@@ Line 16: / Line 20: @@
   openssl req -new -key client.key -out client.csr
   openssl ca -in client.csr -out client.cer
 == Revoking SSL Cert: ==

←Older revision		Revision as of 02:02, 4 March 2016
Line 33:		Line 33:
	== Testing ==		== Testing ==
	openssl s_client -connect domainname:993		openssl s_client -connect domainname:993
		+
		+	Assuming your certificates are in PEM format, you can do:
		+	openssl verify cert.pem
		+
		+	If your "ca-bundle" is a file containing additional intermediate certificates in PEM format:
		+	openssl verify -untrusted ca-bundle cert.pem
		+
		+	If your openssl isn't set up to automatically use an installed set of root certificates (e.g. in /etc/ssl/certs), then you can use -CApath or -CAfile to specify the CA.

←Older revision		Revision as of 23:10, 3 March 2016
Line 33:		Line 33:
	== Testing ==		== Testing ==
	openssl s_client -connect domainname:993		openssl s_client -connect domainname:993
−	~~openssl s_client -connect domainname:993 -starttls imap~~

@@ Line 32: / Line 32: @@
 == Testing ==
+ openssl s_client -connect domainname:993
-openssl s_client -connect domainname:993 -starttls imap
+ openssl s_client -connect domainname:993 -starttls imap

@@ Line 20: / Line 20: @@
 *[http://superuser.com/questions/126121/how-to-create-my-own-certificate-chain/418429 Generate SSl Chain]
-Revoking SSL Cert:
+== Revoking SSL Cert: ==
 In the default configuration, openssl will keep copies of all signed certificates in /etc/pki/CA/newcerts, named by its index number. So grep /etc/pki/index.txt to obtain the serial number of the key to be revoked, e.g. 1000, then execute the following command:
@@ Line 30: / Line 30: @@
 Then run the following to revoke the cert:
    openssl ca -revoke /etc/pki/CA/newcerts/1000.pem

←Older revision		Revision as of 22:56, 3 March 2016
Line 19:		Line 19:
	*[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.2/html/Developer_Guide/Creating_an_SSL_Certificate.html CA Issue Source]		*[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.2/html/Developer_Guide/Creating_an_SSL_Certificate.html CA Issue Source]
	*[http://superuser.com/questions/126121/how-to-create-my-own-certificate-chain/418429 Generate SSl Chain]		*[http://superuser.com/questions/126121/how-to-create-my-own-certificate-chain/418429 Generate SSl Chain]
		+
		+	Revoking SSL Cert:
		+	In the default configuration, openssl will keep copies of all signed certificates in /etc/pki/CA/newcerts, named by its index number. So grep /etc/pki/index.txt to obtain the serial number of the key to be revoked, e.g. 1000, then execute the following command:
		+
		+	cat /etc/pki/CA/index.txt
		+
		+	The following line will appear:
		+	V 170303223153Z 1000 unknown /C=CA/ST=British Columbia/O=HyperSecurity Solutions/OU=Mail/CN=mail.hypersecuresolutions.com/emailAddress=info@hypersecuresolutions.com
		+
		+	Then run the following to revoke the cert:
		+	openssl ca -revoke /etc/pki/CA/newcerts/1000.pem

@@ Line 13: / Line 13: @@
 Now to generate and sign a cert:
   openssl genrsa -out client.key 1024
   openssl req -new -key client.key -out client.csr
   openssl ca -in client.csr -out client.cer
 *[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.2/html/Developer_Guide/Creating_an_SSL_Certificate.html CA Issue Source]
 *[http://superuser.com/questions/126121/how-to-create-my-own-certificate-chain/418429 Generate SSl Chain]