Straightforward Generation of Self-Signed CA for Testing

A common and straightforward question on ##openssl is that someone needs to invent some certificates for testing. For a single host a self-signed certificate is acceptable, which can quickly be made in two steps:

openssl genrsa -out selfsign.key 2048
openssl req -new -x509 -key selfsign.key -out selfsign.crt -sha256
# ... then follow the interactive prompts 
 
When you are doing things like TLS Client Authentication or generally need a certificate that will verify the fastest way is to invent your own CA (certificate authority):

This takes five steps (and filling out the interactive prompts after each 'req'):

openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -days 3650 -out ca.crt -sha256

openssl genrsa -out host.key 2048
openssl req -new -key host.key -sha256 -out host.csr

openssl x509 -req -days 3650 -in host.csr -out host.crt -CAkey ca.key -CA ca.crt -sha256 -set_serial 2 
 
The first two generate the self-signed certificate that will be the CA. A root CA by definition is self-signed, you just choose as a user that this particular certificate is a trusted root CA.

The second two generate a CSR (certificate signing request) that we want the CA to sign.

The last step takes the CSR and signs it with the root CA, which sets the 'issuer' attribute in the certificate to reflect the CA.

To sign more certificates, change the -set_serial to be the next number, and change from host.key, host.csr and host.crt to the new files.

To inspect any certificate use: openssl x509 -in certificate-file.crt -text -noout if it is in PEM format , which is the default for the above commands. Certificate file extensions are for people, not for the cryptographic libraries. You may name these files whatever you want, but it is up to you to understand the application and usage to make sure they are in the proper format. If they are not in the right format seek out how to convert them to the correct format.

After you understand this a little better you will want to revise how each certificate is generated and probably introduce an intermediate CA for signing. This will allow you to set the root CA to have a much longer lifespan but still be able to manage. A great way to see what options you might want to set is to look in the wild with openssl s_client -connect google.com:443 | openssl x509 -text -noout and research attributes you think are important.

Notes:

• '-sha256' is added because of the Google (among other companies and groups) pushing to sunset sha1 signed certificates.
• These commands work as-is on openssl 0.9.8, 1.0.0 and 1.0.1
• ##openssl on irc.freenode.net