This is a reminder for me about how to set up 2 steps CA using OpenSSL in Scientific Linux 6.1 (should also apply to CentOS)
Most OpenSSL HowTo (that I can find using google) is quite old, although the concepts are still the same
My Requirements:
- 2 Steps CA ie: ROOT CA and Intermediate CA
- ROOT CA is valid for 10 years, Intermediate CA is valid for 3 years. All other Certificate is valid for 1 year
- All private keys are 8192 bits long and protected with random pass phrase up to 30 characters long
- All certificates will have Key Usage field defined to minimize misuse
- Certificate Digest using sha512, since sha1 is considered broken by now. OpenSSL 1.0 support sha512. To verify what digest method available run
# openssl dgst -h
- Root CA and Intermediate CA will be exported in format suitable for Mozilla and Windows
OpenSSL1.0 is installed with base system. The structure for CA is located in /etc/pki/CA with system wide openssl.cnf located in /etc/pki/tls/openssl.cnf
We will make copy of /etc/pki/CA to /etc/pki/rootCA as our Root CA directory, then we will link required files to /etc/pki/CA
- # cp -r /etc/pki/CA /etc/pki/rootCA
First we make some changes to the stock openssl.cnf to better reflect our organization
- # cp /etc/pki/tls/openssl.cnf /etc/pki/rootCA/rootca.cnf
- # vi /etc/pki/rootCA/rootca.cnf
Changes in section [ CA_default ]
dir = /etc/pki/rootCA
certificate = $dir/rootcacert.pem
private_key = $dir/private/rootcakey.pem
crl = $dir/rootcrl.pem
default_days = 1096
default_md = sha512
Changes in section [ req ]
default_bits = 8192
default_md = sha512
req_extensions = v3_req
Changes in [ req_distinguished_name ]
as needed
add commonName_default = some name
Changes in [ usr_cert ]
basicConstraints=CA:TRUE, pathlen:0
keyUsage = critical, cRLSign, keyCertSign
crlDistributionPoints = URI:http:///your-webserver/rootca.crl
Changes in [ v3_req ]
basicConstraints = CA:TRUE, pathlen:0
keyUsage = critical, cRLSign, keyCertSign
Changes in [ v3_ca ]
keyUsage = critical, cRLSign, keyCertSign
To create ROOT CA private key
- # openssl genrsa -des3 -out /etc/pki/rootCA/private/rootcakey.pem 8192
When prompted for password, generate strong password (www.strongpasswordgenerator.com). Remember to document it somewhere safe (physically)
- Secure it using mode 400
# chmod 400 /etc/pki/rootCA/private/rootcakey.pem
To create self signed ROOT CA Certificate
- # openssl req -new -x509 -days 3653 -key /etc/pki/rootCA/private/rootcakey.pem -out /etc/pki/rootCA/rootcacert.pem -config /etc/pki/rootCA/rootca.cnf
- Secure it
# chmod 400 /etc/pki/rootCA/rootcacert.pem
- Verify it
# openssl x509 -noout -text -in /etc/pki/rootCA/rootcacert.pem
Should have
X509v3 Basic Constraints:
CA:TRUE
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
Prepare ROOT CA directories and files
- # touch /etc/pki/rootCA/index.txt
- # echo '01' > /etc/pki/rootCA/serial
- # echo '01' > /etc/pki/rootCA/crlnumber
Next we need to create our Intermediate CA-1
- # cp -r /etc/pki/CA /etc/pki/CA1
Next we need to create Intermediate CA1 private key like above, just alter the file name
- # openssl genrsa -des3 -out /etc/pki/CA1/private/cakey.pem 8192
When prompted for password, generate strong password (www.strongpasswordgenerator.com). Remember to document it somewhere safe (physically)
- Secure it using mode 400
# chmod 400 /etc/pki/CA1/private/cakey.pem
Next Create Certificate Request for CA1
- # openssl req -new -key /etc/pki/CA1/private/cakey.pem -out /etc/pki/rootCA/request/ca1cert.req -config /etc/pki/rootCA/rootca.cnf
- Verify it
# openssl req -in /etc/pki/rootCA/request/ca1cert.req -noout -text
Should have this section
Requested Extensions:
X509v3 Basic Constraints:
CA:TRUE, pathlen:0
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
Then we sign it using Root CA
- # openssl ca -config /etc/pki/rootCA/rootca.cnf -infiles /etc/pki/rootCA/request/ca1cert.req
- The copy of CA1 certificate will be placed at /etc/pki/rootCA/newcerts/01.pem
- Move /etc/pki/rootCA/newcerts/01.pem to /etc/pki/rootCA/certs/01.pem
- Make symbolic link of /etc/pki/rootCA/certs/01.pem to /etc/pki/CA1/cacert.pem
# ln -s /etc/pki/rootCA/certs/01.pem /etc/pki/CA1/cacert.pem
We now have our Intermediate CA-1 privatekey and public certificate. Next we prepare Intermediate CA-1 configuration and directories
First we copy /etc/pki/tls/openssl.cnf to /etc/pki/CA1/CA1.cnf
Make some changes to reflect that this is Intermediate CA-1
- # vi /etc/pki/CA1/CA1.cnf
Changes in section [ CA_default ]
dir = /etc/pki/CA1
certificate = $dir/cacert.pem
private_key = $dir/private/cakey.pem
crl = $dir/CA1crl.pem
default_days = 1000
default_md = sha512
Changes in section [ req ]
default_bits = 8192
default_md = sha512
req_extensions = v3_req
Changes in [ req_distinguished_name ]
as needed
Changes in [ usr_cert ]
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage=serverAuth
crlDistributionPoints = URI:http:///your-webserver/ca1.crl
subjectAltName=${ENV::SubjectAltName} #needed by Chrome 58
Changes in [ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage=serverAuth
subjectAltName=${ENV::SubjectAltName} #needed by Chrome 58
Changes in [ v3_ca ]
keyUsage = critical, cRLSign, keyCertSign
- # touch /etc/pki/CA1/index.txt
- # echo '01' > /etc/pki/CA1/serial
- # echo '01' > /etc/pki/CA1/crlnumber
Done!!
We have our Root CA and CA1 ready to sign certificate requests. We should export Root CA and CA1 Certificate to our intended client (Your LAN Users)
Example to sign certificate request for HTTPS Server called farseer
We will create the request from CA1 directory (In practice this should be done on the requesting server using their own certificate request tool)
- First, create private key (in this example, the key is encrypted. You may want to NOT encrypt it to simplify httpd startup)
# openssl genrsa -des3 -out /etc/pki/CA1/private/farseer.pem 8192
- Create CSR
# SubjectAltName=DNS:farseer openssl req -new -key /etc/pki/CA1/private/farseer.pem -out /etc/pki/CA1/request/farseer.req -config /etc/pki/CA1/CA1.cnf
- Sign the CSR
# SubjectAltName=DNS:farseer openssl ca -config /etc/pki/CA1/CA1.cnf -infiles /etc/pki/CA1/request/farseer.req
Then configure /etc/httpd/conf.d/ssl.conf to point to the new sslcert and private key
In any case to revoke the signed certificate use these command
- SubjectAltName= openssl ca -config CA1.cnf -revoke newcerts/<certificate file>
- SubjectAltName= openssl ca -config CA1.cnf -gencrl -out crl/<crl file>
- then copy the generated crl file to the distribution point.
- this CRL has expiration date that can be verified by
openssl crl -in crl/<crl file> -noout -text
Additional info:
#20170505#: Google Chrome starting from version 58 has deprecated the usage of CommonName in https connection and require subjectAltName.
I choose to use environment variable to pass this subjectAltName value to CA1.cnf file.
There is another option to create temporary cnf file that will be unique to every certificate request and signing and supply the value in that temporary cnf file
Additional info:
#20140622#: Got a Fortigate100D unit, and setup SSL VPN using this steps with several modification
- Use only 2048 bit RSA key and sha256, when using 8196 RSA key with sha512 Fortigate refuse to get the tunnel up
- Change string_mask from utf8only to string_mask = default. Fortigate use PRINTABLE STRING (old standard/before 2004) in the built in CSR management. Not sure if this is necessary or not.
- For CA1 client signing (since Fortigate use PRINTABLE STRING and we have match it in string_mask, we need to ignore mismatch from user CSR in Windows that use utf8). Check with openssl asn1parse command.
- # For the CA policy
- [ policy_match ]
- countryName = match
- stateOrProvinceName = match
- organizationName = match
- #countryName = optional (utf8 client)
- #stateOrProvinceName = optional (utf8 client)
- #organizationName = optional (utf8 client)
