OpenSSL "ca" - Create CA Certificate for Testing

Q

How to generate a new root CA certificate to test the OpenSSL "ca" command?

✍: FYIcenter.com

A

If you need some root CA (Certificate Authority) certificates for testing purpose, you can generate them using the OpenSSL "req" command as shown below:

C:\Users\fyicenter>\local\OpenSSL-Win32\bin\openssl.exe

OpenSSL> req -x509 -newkey rsa:1024 -keyout my_ca.key -out my_ca.crt
Generating a 1024 bit RSA private key
....++++++
........................++++++
writing new private key to 'my_ca.key'
Enter PEM pass phrase:fyicenter
Verifying - Enter PEM pass phrase:fyicenter
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:TX
Locality Name (eg, city) []:City
Organization Name (eg, company) [Internet Widgits Pty Ltd]:FYIcenter.com
Organizational Unit Name (eg, section) []:Security
Common Name (e.g. server FQDN or YOUR name) []:FYIcenter Root CA
Email Address []:root-ca@fyicenter.com

Notes about this test:

  • The "-x509" option tells "req" command to generate a self-signed root CA certificate. Root CA certificates are always self-signed.
  • The "-newkey rsa:1024" option tells "req" command to generate a new pair of 1024-bit RSA private key and public key.
  • The "-keyout my_ca.key" option tells "req" command to save the RSA private key (with the public key too) to file "privkey.pem".
  • The "-out my_ca.crt" option tells "req" command to save the new root certificate to file "my_ca.crt".
  • The "Enter PEM pass phrase:fyicenter" prompt indicates that the RSA private key file "privkey.pem" was encrypted with the "fyicenter" password.

 

OpenSSL "ca" Error "./demoCA/newcerts: No such file or directory"

OpenSSL "ca" - Create CSR for Testing

OpenSSL "ca" Command

⇑⇑ OpenSSL Tutorials

2016-09-18, 1119👍, 0💬