How to create SSL CA Cert Server

OpenSSL needs to have a CA directory created in order to sign crt requests. Use the following steps to create a CA server, then generate/sign keys:

Run the following to create a CA directory:

cd /etc/pki/
mv CA CA.original
CA.pl -newca
mv demoCA CA

Fix CA issues:

touch /etc/pki/CA/index.txt
echo '1000' > /etc/pki/CA/serial

Now to generate and sign a cert:

1. Create a Certificate Authority private key (this is your most important key):

openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key

1. Create your CA self-signed certificate:

openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem

1. Issue a client certificate by first generating the key, then request (or use one provided by external system) then sign the certificate using private key of your CA:

openssl genrsa -out client.key 1024
openssl req -new -key client.key -out client.csr
openssl ca -in client.csr -out client.cer

• CA Issue Source
• Generate SSl Chain