OPENSSL CONFIG UPDATE

Issuer: C = US, ST = WA, O = Grilled Cheese Inc., OU = Grilled Cheese Intermediary CA, CN = Grilled Cheese Inc. Validate the certificate # openssl x509 -noout -text -in intermediate/certs/ Root Certificate Key Usage: criticalĬertificate is to be certified until Sep 6 20:10:39 2019 GMT (730 days)ġ out of 1 certificate requests certified, commit? y OrganizationalUnitName = Grilled Cheese Dev Lab Using configuration from intermediate/openssl_server.cnfĮnter pass phrase for /root/ca/intermediate/private/:Ĭheck that the request matches the signature # openssl ca -config intermediate/openssl_server.cnf -extensions server_cert -days 730 -in intermediate/csr/ -out intermediate/certs/

Use the intermediary certificate to create and sign the CSR for.

If you enter '.', the field will be left blank. There are quite a few fields but you can leave some blankįor some fields there will be a default value, What you are about to enter is what is called a Distinguished Name or a DN. You are about to be asked to enter information that will be incorporated Writing new private key to 'intermediate/private/' # openssl req -config intermediate/openssl_server.cnf -new -newkey ec:<(openssl ecparam -name secp384r1) -keyout intermediate/private/ -out intermediate/csr/ We also need to ensure our certificate's hash function matches the signing CA, in our case SHA-384. If we created the CA using P-256, we would not be able to use P-384 for the client/server certificate. Since the root and intermediary CA's use P-384, Suite B allows us to use either. Create the private key and CSR.Ĭreate the private key and CSR and specify either P-256 or P-384 approved curves. We'll worry about scripting and simplifying that process in another followup article.

OPENSSL CONFIG UPDATE

You'll need to either update the openssl_server.cnf every time you want to create a new certificate or create a copy for each new certificate. You're also thinking, how does this scale for multiple CSRs? It doesn't. However there are practical and application limitations so plan your certificate's alternate names wisely and try to match what you would implement in production. RFC 5280 regarding subject alternative names states no upper bound limit is defined (no limit to how many names you can enter). Below is an example of the openssl config formatting for multiple names. You can add additional names to the certificate by iterating the section. This alternative name should match what we enter for the field.

The openssl_server.cnf file has new entries at the location to create the subjectAltName field our certificate mentioned in the earlier noted points. Openssl currently supports population of SubjectAltName through configuration files only, including the current version v1.1.0f (true at guides publication date) 2.Ĭopy the Gist openssl_server.cnf file to /root/ca/intermediate/openssl_server.cnf and modify the contents for your own naming conventions.Certificates MUST have subjectAltName (SAN) extensions of type DNSName defined 1.What's becoming a theme there are two caveats to note prior to creating our first server CSR. Now we are ready to create our first server certificate and sign them with our fully armed and operational CA. Previously on Building an OpenSSL CA, we created a certificate revocation list, OCSP certificate, and updated our OpenSSL configuration file to include revokation URI data.

Openssl config