certificate.md

CA configuration file

Instructions of this file based on: https://www.kevinleary.net/self-signed-trusted-certificates-node-js-express-js/

wget https://raw.githubusercontent.com/anders94/https-authorized-clients/master/keys/ca.cnf

[ ca ]
default_ca      = CA_default

[ CA_default ]
serial = ca-serial
crl = ca-crl.pem
database = ca-database.txt
name_opt = CA_default
cert_opt = CA_default
default_crl_days = 9999
default_md = md5

[ req ]
default_bits           = 4096
days                   = 9999
distinguished_name     = req_distinguished_name
attributes             = req_attributes
prompt                 = no
output_password        = password

[ req_distinguished_name ]
C                      = US
ST                     = MA
L                      = Boston
O                      = Example Co
OU                     = techops
CN                     = ca
emailAddress           = certs@example.com

[ req_attributes ]
challengePassword      = test

From man page, sample configuration file prompting for field values:

        [ req ]
        default_bits           = 2048
        default_keyfile        = privkey.pem
        distinguished_name     = req_distinguished_name
        attributes             = req_attributes
        x509_extensions        = v3_ca

        dirstring_type = nobmp

        [ req_distinguished_name ]
        countryName                    = Country Name (2 letter code)
        countryName_default            = AU
        countryName_min                = 2
        countryName_max                = 2

        localityName                   = Locality Name (eg, city)

        organizationalUnitName         = Organizational Unit Name (eg, section)

        commonName                     = Common Name (eg, YOUR name)
        commonName_max                 = 64

        emailAddress                   = Email Address
        emailAddress_max               = 40

        [ req_attributes ]
        challengePassword              = A challenge password
        challengePassword_min          = 4
        challengePassword_max          = 20

        [ v3_ca ]

        subjectKeyIdentifier=hash
        authorityKeyIdentifier=keyid:always,issuer:always
        basicConstraints = CA:true

       Sample configuration containing all field values:

        RANDFILE               = $ENV::HOME/.rnd

        [ req ]
        default_bits           = 2048
        default_keyfile        = keyfile.pem
        distinguished_name     = req_distinguished_name
        attributes             = req_attributes
        prompt                 = no
        output_password        = mypass

Certificate authority

Create a new certificate authority using the above configuration

openssl req -new -x509 -days 9999 -config ca.cnf -keyout ca-key.pem -out ca-crt.pem

Server private key

openssl genrsa -out server-key.pem 4096

Certificate signing request

Signing request config

Use server.cnf as a configuration to simplify the process:

wget https://raw.githubusercontent.com/anders94/https-authorized-clients/master/keys/server.cnf

[ req ]
default_bits           = 4096
days                   = 9999
distinguished_name     = req_distinguished_name
attributes             = req_attributes
prompt                 = no
x509_extensions        = v3_ca

[ req_distinguished_name ]
C                      = US
ST                     = MA
L                      = Boston
O                      = Example Co
OU                     = techops
CN                     = localhost
emailAddress           = certs@example.com

[ req_attributes ]
challengePassword      = password

[ v3_ca ]
authorityInfoAccess = @issuer_info

[ issuer_info ]
OCSP;URI.0 = http://ocsp.example.com/
caIssuers;URI.0 = http://example.com/ca.cert

Generate the certificate signing request:

openssl req -new -config server.cnf -key server-key.pem -out server-csr.pem

Sign the request

other resource

Other platform: https://stackoverflow.com/questions/21397809/create-a-trusted-self-signed-ssl-cert-for-localhost-for-use-with-express-node/21398485 https://ram.k0a1a.net/self-signed_https_cert_after_chrome_58 https://www.akadia.com/services/ssh_test_certificate.html

Getting Chrome to accept self-signed localhost certificate: https://stackoverflow.com/a/12478732/646732