creating-self-signed-certificates

creating-self-signed-certificates.txt

# Generate fake signing key and request
openssl req -utf8 -nameopt multiline,utf8 -config real-cert-data.conf -new -sha256 -newkey rsa:4096 -nodes -keyout real-key.pem -days 730 -out real-req.pem

# Check the fake signing key and request
openssl req -text -nameopt lname,sep_multiline,utf8 -in real-req.pem -noout
# or
openssl req -text -nameopt lname,utf8 -in real-req.pem -noout | grep Subject:

# Self-sign the fake certificate request
openssl x509 -req -nameopt lname,utf8 -days 730 -in real-req.pem -signkey real-key.pem -out real-cert.crt

# View the self-signed certificate request
openssl x509 -nameopt lname,sep_multiline,utf8 -in real-cert.crt -text -noout
# or
openssl x509 -nameopt lname,utf8 -in real-cert.crt -text -noout | grep Subject:
openssl x509 -nameopt lname,utf8 -in real-cert.crt -text -noout | grep Issuer:

# Get the public key
openssl x509 -in real-cert.crt -noout -pubkey -out real-cert.pub

################################################
# Malicious certificate
################################################

# Generate fake signing key and request
openssl req -utf8 -nameopt multiline,utf8 -config fake-cert-data.conf -new -sha256 -newkey rsa:4096 -nodes -keyout fake-key.pem -days 730 -out fake-req.pem

# Check the fake signing key and request
openssl req -text -nameopt lname,sep_multiline,utf8 -in fake-req.pem -noout
# or
openssl req -text -nameopt lname,utf8 -in fake-req.pem -noout | grep Subject:

# Self-sign the fake certificate request
openssl x509 -req -nameopt multiline,utf8 -days 730 -in fake-req.pem -signkey fake-key.pem -out fake-cert.crt

# View the self-signed certificate request
openssl x509 -nameopt lname,sep_multiline,utf8 -in fake-cert.crt -text -noout
# or
openssl x509 -nameopt lname,utf8 -in fake-cert.crt -text -noout | grep Subject:
openssl x509 -nameopt lname,utf8 -in fake-cert.crt -text -noout | grep Issuer:

# Get the public key
openssl x509 -in fake-cert.crt -noout -pubkey -out fake-cert.pub

################################################
# Signing text artifact
################################################

# Sign the artifact with the real key
openssl dgst -sign real-key.pem -keyform PEM -sha256 -out artifact-real.sign -binary artifact.txt

# Verify the real signature
openssl dgst -verify real-cert.pub -keyform PEM -sha256 -signature artifact-real.sign -binary artifact.txt

# Sign the artifact with the fake key
openssl dgst -sign fake-key.pem -keyform PEM -sha256 -out artifact-fake.sign -binary artifact.txt

# Verify the fake signature
openssl dgst -verify fake-cert.pub -keyform PEM -sha256 -signature artifact-fake.sign -binary artifact.txt