Openssl ca - Revision history

Busk at 18:00, 19 May 2024

2024-05-19T18:00:51Z

Busk at 17:59, 19 May 2024

2024-05-19T17:59:59Z

Busk at 01:48, 5 May 2024

2024-05-05T01:48:21Z

Busk at 01:42, 5 May 2024

2024-05-05T01:42:13Z

Busk at 01:26, 5 May 2024

2024-05-05T01:26:01Z

Busk at 01:24, 5 May 2024

2024-05-05T01:24:28Z

Busk at 20:31, 4 May 2024

2024-05-04T20:31:44Z

Busk at 19:58, 4 May 2024

2024-05-04T19:58:34Z

Busk at 19:55, 4 May 2024

2024-05-04T19:55:48Z

Busk at 19:48, 4 May 2024

2024-05-04T19:48:30Z

@@ Line 27: / Line 27: @@
 # Generate Sub-CA certificate signing request
 openssl genpkey -aes256 -algorithm RSA -out subCA.key -pass env:SUBCA_PASS
 openssl req -new -key subCA.key -out subCA.csr -subj "/CN=Sub CA" -passin env:SUBCA_PASS -addext "basicConstraints=CA:true,pathlen:0"
@@ Line 49: / Line 48: @@
 # Create and sign foo.example.com
 openssl genpkey -algorithm RSA -out foo.key  # to encrypt add -aes256
-openssl req -new -key foo.key -out foo.csr -subj "/CN=foo.example.com" -addext "subjectAltName=DNS:foo.example.com,DNS:foo1.example.com,DNS:foo2.example.com,DNS:foo3.example.com,DNS:foo4.example.com,DNS:foo5.example.com"
+openssl req -new -key foo.key -out foo.csr -subj "/CN=foo.example.com" -addext "subjectAltName=DNS:foo.example.com,DNS:foo1.example.com,DNS:foo2.example.com,DNS:foo3.example.com,DNS:foo4.example.com,DNS:foo5.example.com,IP:192.168.1.1"
 openssl x509 -req -in foo.csr -CA subCA.crt -CAkey subCA.key -passin env:SUBCA_PASS -out vault.crt -days 365 -copy_extensions copyall

@@ Line 3: / Line 3: @@
 ## .env.secret
 ```
-export ROOTCA_PASS=foo1
+export ROOTCA_PASS=ChangeThis
-export SUBCA_PASS=foo2
+export SUBCA_PASS=ChangeThat
 ```
 ## source env vars
@@ Line 26: / Line 26: @@
 # Generate Sub-CA certificate signing request
-openssl genpkey -aes256 -algorithm RSA -out subCA.key -pass pass:$SUBCA_PASS
+openssl genpkey -aes256 -algorithm RSA -out subCA.key -pass env:SUBCA_PASS
-openssl req -new -key subCA.key -out subCA.csr -subj "/CN=Sub CA" -passin env:SUBCA_PASS -addext "subjectAltName = DNS:example.com,DNS:www.example.com,IP:192.168.1.1" -addext "basicConstraints=CA:true,pathlen:0"
+# openssl req -new -key subCA.key -out subCA.csr -subj "/CN=Sub CA" -passin env:SUBCA_PASS -addext "subjectAltName = DNS:example.com,DNS:www.example.com,IP:192.168.1.1" -addext "basicConstraints=CA:true,pathlen:0"
 # Sign the Sub-CA certificate using the Root CA
-openssl x509 -req -in subCA.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out subCA.crt -days 365 -passin env:ROOT_CA_PASS -copy_extensions copyall
+openssl x509 -req -in subCA.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out subCA.crt -days 365 -passin env:ROOTCA_PASS -copy_extensions copyall
 # Generate Client key
@@ Line 36: / Line 40: @@
 # Generate Client certificate signing request
-openssl req -new -key client.key -out client.csr -subj "/CN=Client" -passin env:SUB_CA_PASS -addext "subjectAltName = URI:https://www.example.org/resource" -addext "extendedKeyUsage = clientAuth"
+openssl req -new -key client.key -out client.csr -subj "/CN=Client" -passin env:SUBCA_PASS -addext "subjectAltName = URI:https://www.example.org/resource" -addext "extendedKeyUsage = clientAuth"
 openssl req -text -in client.csr
@@ Line 42: / Line 46: @@
 openssl x509 -req -in client.csr -CA subCA.crt -CAkey subCA.key -passin env:SUBCA_PASS -out client.crt -days 365 -copy_extensions copyall
 openssl x509 -text -in client.crt
 date > initialized

← Older revision		Revision as of 01:48, 5 May 2024
Line 235:		Line 235:
	In summary, keyUsage is more general and covers basic cryptographic operations, while extendedKeyUsage provides more specific details about how the certificate can be used, including specific application purposes. Both extensions are optional in a certificate, and their presence or absence can impact how the certificate is interpreted and used by various systems.		In summary, keyUsage is more general and covers basic cryptographic operations, while extendedKeyUsage provides more specific details about how the certificate can be used, including specific application purposes. Both extensions are optional in a certificate, and their presence or absence can impact how the certificate is interpreted and used by various systems.

		+	```
		+
		+	# Passwords
		+	```
		+	env:somevar to get the password from an environment variable
		+	file:somepathname to get the password from the first line of the file at location pathname
		+	fd:number to get the password from the file descriptor number.
		+	stdin to read from standard input
		+	Now that I've written this question and answer, it all seems obvious. But it certainly took some time to figure out and I'd seen it take others similar time, so hopefully this can cut down that time and answer faster for others! :)
		+
		+	With OpenSSL 1.0.1e the parameter to use is -passin or -passout. So this example would be:
		+
		+	openssl aes-256-cbc -in some_file.enc -out some_file.unenc -d -passin pass:somepassword
	```		```

@@ Line 44: / Line 44: @@
 date > initialized
 ```
@@ Line 216: / Line 234: @@
 extendedKeyUsage: This extension further refines the usage of the certificate beyond what is covered by keyUsage. It specifies the specific extended key usages, such as client authentication, server authentication, code signing, email protection, and time stamping.
 In summary, keyUsage is more general and covers basic cryptographic operations, while extendedKeyUsage provides more specific details about how the certificate can be used, including specific application purposes. Both extensions are optional in a certificate, and their presence or absence can impact how the certificate is interpreted and used by various systems.
 ```

@@ Line 3: / Line 3: @@
 ## .env.secret
 ```
-export ROOT_CA_PASS=foo1
+export ROOTCA_PASS=foo1
-export SUB_CA_PASS=foo2
+export SUBCA_PASS=foo2
 ```
 ## source env vars
@@ Line 21: / Line 21: @@
 # Generate Root CA key
-openssl genpkey -aes256 -algorithm RSA -out rootCA.key -pass env:ROOT_CA_PASS
+openssl genpkey -aes256 -algorithm RSA -out rootCA.key -pass env:ROOTCA_PASS
-openssl req -x509 -new -key rootCA.key -out rootCA.crt -days 365 -subj "/CN=Root CA" -passin env:ROOT_CA_PASS -addext "basicConstraints=CA:true,pathlen:1"
+openssl req -x509 -new -key rootCA.key -out rootCA.crt -days 365 -subj "/CN=Root CA" -passin env:ROOTCA_PASS -addext "basicConstraints=CA:true,pathlen:1"
 # Generate Sub-CA certificate signing request
-openssl genpkey -aes256 -algorithm RSA -out subCA.key -pass pass:$SUB_CA_PASS
+openssl genpkey -aes256 -algorithm RSA -out subCA.key -pass pass:$SUBCA_PASS
-openssl req -new -key subCA.key -out subCA.csr -subj "/CN=Sub CA" -passin env:SUB_CA_PASS -addext "subjectAltName = DNS:example.com,DNS:www.example.com,IP:192.168.1.1" -addext "basicConstraints=CA:true,pathlen:0"
+openssl req -new -key subCA.key -out subCA.csr -subj "/CN=Sub CA" -passin env:SUBCA_PASS -addext "subjectAltName = DNS:example.com,DNS:www.example.com,IP:192.168.1.1" -addext "basicConstraints=CA:true,pathlen:0"
 # Sign the Sub-CA certificate using the Root CA
@@ Line 33: / Line 33: @@
 # Generate Client key
-openssl genpkey -aes256 -algorithm RSA -out client.key -pass env:SUB_CA_PASS
+openssl genpkey -aes256 -algorithm RSA -out client.key -pass env:SUBCA_PASS
 # Generate Client certificate signing request
@@ Line 40: / Line 40: @@
 # Sign CA and allow all extentions from CSR
-openssl x509 -req -in client.csr -CA subCA.crt -CAkey subCA.key -passin env:SUB_CA_PASS -out client.crt -days 365 -copy_extensions copyall
+openssl x509 -req -in client.csr -CA subCA.crt -CAkey subCA.key -passin env:SUBCA_PASS -out client.crt -days 365 -copy_extensions copyall
 openssl x509 -text -in client.crt

@@ Line 1: / Line 1: @@
 # Subject Alternative Name Types
 ```
@@ Line 103: / Line 137: @@
 Specifies the locations where additional information about the issuer (such as the CA's certificate) can be retrieved.
 These are just some examples of X.509v3 extensions commonly found in client certificates for mTLS. The inclusion of specific extensions may vary depending on the requirements of the certificate issuer and the intended usage of the certificate.
 ```

@@ Line 11: / Line 11: @@
 ```
-## Remote DN
+## Where to put Remote Company info in DN
 ```
 The Directory Name entry in the Subject Alternative Name (SAN) extension of a certificate typically refers to a remote Distinguished Name (DN), not a local one.

@@ Line 9: / Line 9: @@
 Directory Name (directoryName): Specifies a Distinguished Name (DN) of another entity. This is useful when the subject of the certificate is an entity other than the issuer, and it needs to refer to another entity by its DN.
 Other Name (otherName): Specifies a custom identifier or a non-standard identifier. This allows for flexibility in defining additional types of identifiers.
 ```