Creating server certificate - Revision history

Vvc at 14:05, 7 October 2018

2018-10-07T14:05:04Z

← Older revision		Revision as of 14:05, 7 October 2018
Line 22:		Line 22:

	# Organization (eg. company)		# Organization (eg. company)
	O=~~VVC~~		O=Vadym Chepkov

	# Organizational Unit Name (eg. section)		# Organizational Unit Name (eg. section)

Vvc at 14:03, 7 October 2018

2018-10-07T14:03:35Z

← Older revision		Revision as of 14:03, 7 October 2018
Line 6:		Line 6:
	[ req ]		[ req ]
	default_bits = 2048		default_bits = 2048
	default_md = ~~sha1~~		default_md = sha256
	distinguished_name = req_dn		distinguished_name = req_dn
	req_extensions = cert_type		req_extensions = cert_type
Line 16:		Line 16:

	# State or Province Name (full name)		# State or Province Name (full name)
	ST=~~Missouri~~		ST=Virginia

	# Locality Name (eg. city)		# Locality Name (eg. city)
	L=~~St. Louis~~		L=Leesburg

	# Organization (eg. company)		# Organization (eg. company)
	O=~~IVK/~~VVC		O=VVC

	# Organizational Unit Name (eg. section)		# Organizational Unit Name (eg. section)
	OU=~~VPS1 server~~		OU=IT

	# Common Name (*.example.com is also possible)		# Common Name (*.example.com is also possible)
	CN=~~vps1.~~chepkov.com		CN=chepkov.com

	# E-mail contact		# E-mail contact
	emailAddress=~~root~~@~~ivk~~.com~~.au~~		emailAddress=vvc@chepkov.com

	[ cert_type ]		[ cert_type ]
	keyUsage=digitalSignature,keyEncipherment		keyUsage=digitalSignature,keyEncipherment
	extendedKeyUsage=serverAuth		extendedKeyUsage=serverAuth
	subjectAltName=IP:~~209~~.20.~~74.232~~,DNS:~~vps1.~~chepkov.com,~~DNS~~:~~ivk~~.~~com~~.au		subjectAltName=DNS:www.chepkov.com,DNS:chepkov.com,IP:50.116.54.18
	</pre>		</pre>
	*Note: Using a file like this with ''subjectAltName'' is the only way to generate a request that will result in a certificate that is valid for more than one ''name''.		*Note: Using a file like this with ''subjectAltName'' is the only way to generate a request that will result in a certificate that is valid for more than one ''name''.

Vvc: /* Generate self-signed certificate */

2016-10-16T15:23:51Z

Generate self-signed certificate

← Older revision		Revision as of 15:23, 16 October 2016
Line 50:		Line 50:

	=== Generate self-signed certificate ===		=== Generate self-signed certificate ===
	openssl req -x509 ~~-new~~ -days 3650 -key server.key -out server.crt -config server.cnf -extensions cert_type		openssl req -new -x509 -days 3650 -key server.key -out server.crt -config server.cnf -extensions cert_type

	[[Category:OpenSSL]]		[[Category:OpenSSL]]

Vvc at 15:23, 16 October 2016

2016-10-16T15:23:22Z

← Older revision		Revision as of 15:23, 16 October 2016
Line 48:		Line 48:
	Now you need to send your request to a certificate authority or if you have your own, sign the request (see [[Managing_Certificate_Authority#Signing_Certificate_Request\|example]])		Now you need to send your request to a certificate authority or if you have your own, sign the request (see [[Managing_Certificate_Authority#Signing_Certificate_Request\|example]])
	You will get server certificate server.crt		You will get server certificate server.crt

			=== Generate self-signed certificate ===
			openssl req -x509 -new -days 3650 -key server.key -out server.crt -config server.cnf -extensions cert_type

	[[Category:OpenSSL]]		[[Category:OpenSSL]]

Vvc: /* Create openssl config file */

2016-02-26T14:17:54Z

Create openssl config file

← Older revision		Revision as of 14:17, 26 February 2016
Line 6:		Line 6:
	[ req ]		[ req ]
	default_bits = 2048		default_bits = 2048
	default_md = ~~sha2~~		default_md = sha1
	distinguished_name = req_dn		distinguished_name = req_dn
	req_extensions = cert_type		req_extensions = cert_type

Vvc at 13:39, 16 February 2016

2016-02-16T13:39:14Z

← Older revision		Revision as of 13:39, 16 February 2016
Line 6:		Line 6:
	[ req ]		[ req ]
	default_bits = 2048		default_bits = 2048
	default_md = ~~sha1~~		default_md = sha2
	distinguished_name = req_dn		distinguished_name = req_dn
	req_extensions = cert_type		req_extensions = cert_type

Dburdick: /* Create openssl config file */

2010-07-16T17:15:01Z

Create openssl config file

New page

=== Create openssl config file ===

Here is an example of server.cnf

<pre>
[ req ]
default_bits = 2048
default_md = sha1
distinguished_name = req_dn
req_extensions = cert_type
prompt = no

[ req_dn ]
# country (2 letter code)
C=US

# State or Province Name (full name)
ST=Missouri

# Locality Name (eg. city)
L=St. Louis

# Organization (eg. company)
O=IVK/VVC

# Organizational Unit Name (eg. section)
OU=VPS1 server

# Common Name (*.example.com is also possible)
CN=vps1.chepkov.com

# E-mail contact
emailAddress=root@ivk.com.au

[ cert_type ]
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth
subjectAltName=IP:209.20.74.232,DNS:vps1.chepkov.com,DNS:ivk.com.au
</pre>
*Note: Using a file like this with ''subjectAltName'' is the only way to generate a request that will result in a certificate that is valid for more than one ''name''.

=== Generate server private key ===
openssl genrsa -out server.key 2048

=== Generate certificate request ===
openssl req -new -key server.key -out server.csr -config server.cnf

Now you need to send your request to a certificate authority or if you have your own, sign the request (see [[Managing_Certificate_Authority#Signing_Certificate_Request|example]])
You will get server certificate server.crt
[[Category:OpenSSL]]