RE: doubt regarding certificate generation
From: owner-openssl-us...@openssl.org On Behalf Of Mithun Kumar
Sent: Wednesday, 11 April, 2012 03:16
Thanks Dave could you please elaborate below lines too
Meta-answers: you can read the instructions for any OpenSSL
utility on Unix with man (here man req and man x509)
(you may need to set MANPATH or provide addional options if
OpenSSL isn't installed the 'standard' way on your system).
Or use links in http://www.openssl.org/docs/apps/openssl.html .
You can also get a brief help message for any utility by giving
it an invalid option such as a single hyphen like openssl req - .
$(OPENSSL) req -newkey rsa:1024 -sha1 -keyout rootkey.pem
-out rootreq.pem -config root.cnf
$(OPENSSL) x509 -req -in rootreq.pem -sha1 -extfile root.cnf
-extensions certificate_extensions -signkey rootkey.pem
-out rootcert.pem
$(CAT) rootcert.pem rootkey.pem root.pem
Similar to the commands for your server, this generates a keypair
for a (new) root CA in rootkey.pem and a CSR in rootreq.pem .
It then creates a self-signed cert from that CSR (for that publickey
and DN) in rootcert.pem, and combines key and cert in root.pem .
Note that a root cert is signed by its own key(pair), called
self-signed, whereas other lower or child certs are not.
$(OPENSSL) req -newkey rsa:1024 -sha1 -keyout serverCAkey.pem
-out serverCAreq.pem -config serverCA.cnf
$(OPENSSL) x509 -req -in serverCAreq.pem -sha1 -extfile serverCA.cnf
-extensions certificate_extensions -CA root.pem -CAkey root.pem
-CAcreateserial -out serverCAcert.pem
$(CAT) serverCAcert.pem serverCAkey.pem rootcert.pem serverCA.pem
Almost like your server, this generates a keypair, CSR, and cert
for an intermediate CA under root called serverCA{key,req,cert,}.
Again it isn't necessary to have the root cert in serverCA.pem, but
it may be convenient and doesn't hurt (as long as it isn't first).
These two CAs, root and serverCA, form a private hierarchy used
to issue your server cert as already noted; it can be used for
other certs as well -- although if your procedure (makefile) is
for a specific server it probably cares only about one server.
I didn't bring it up before, but for all these CSRs and certs
I hope the Distinguished Name (DN) fields configured in *.cnf, or
entered interactively, identify them as yours, at least if they
will (ever) be used -- i.e. your server will be used -- by people
other than yourself and maybe your close friends/colleagues.
In particular, for most SSL connections -- including standard
web browsers -- the common name in the server cert MUST be
the name expected by the client, which for a web browser is
the domain part of the URL. For servers on the Internet this
usually must be a DNS name, formally a Fully Qualified Domain
Name or FQDN, because most users won't deal with IP addresses;
if your server is (only) used in a restricted environment like
one department of a company you may have other options.
For the CA certs (root and intermediate) the common name (or
other parts of the DN) don't need to be any specific form, but
they should still be accurate. If you have a DNS name and don't
have any better id for it, you might as well use the DNS name.
BUT: the DNs must be DISTINCT! Do NOT use the same DN for
root and serverCA and server. You can use different DNS-format
names in your domain (even if they're not actually in DNS) or
you can use other DN fields especially OrgUnit.
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: doubt regarding certificate generation
Thanks Dave could you please elaborate below lines too $(OPENSSL) req -newkey rsa:1024 -sha1 -keyout rootkey.pem -out rootreq.pem -config root.cnf $(OPENSSL) x509 -req -in rootreq.pem -sha1 -extfile root.cnf -extensions certificate_extensions -signkey rootkey.pem -out rootcert.pem $(CAT) rootcert.pem rootkey.pem root.pem $(OPENSSL) req -newkey rsa:1024 -sha1 -keyout serverCAkey.pem -out serverCAreq.pem -config serverCA.cnf $(OPENSSL) x509 -req -in serverCAreq.pem -sha1 -extfile serverCA.cnf -extensions certificate_extensions -CA root.pem -CAkey root.pem -CAcreateserial -out serverCAcert.pem $(CAT) serverCAcert.pem serverCAkey.pem rootcert.pem serverCA.pem -Thanks mithun On Wed, Apr 11, 2012 at 1:45 AM, Dave Thompson dthomp...@prinpay.comwrote: From: owner-openssl-us...@openssl.org On Behalf Of Mithun Kumar Sent: Monday, 09 April, 2012 01:54 I am newbie to OpenSSL. I am trying to understand how certificates are generated. I downloaded the samples and started understanding the Makefile that came with the sources. FYI- this is *a* way of generating matching keys and certificates, which is what you need, in OpenSSL. There are other methods. Below is my understanding so far $(OPENSSL) req -newkey rsa:1024 -sha1 -keyout serverkey.pem -out serverreq.pem -config server.cnf -reqexts req_extensions Here we are trying to create a RSA private key with Private Key file serverkey.pem and output file serverreq.pem This creates an RSA key*pair* (private and public) which is stored in CRT format in serverkey.pem, *and* a certficate signing request aka CSR for the publickey half of that keypair in serverreq.pem. Although theoretical RSA public and private keys can be distinct with only (e,n) and (d,n), much better performance is obtained by the CRT implementation which stores e,d,n,p,q plus more. The publickey (e,n) is extracted from CRT format when needed. (CRT here means Chinese Remainder Theorem.) $(OPENSSL) x509 -req -in serverreq.pem -sha1 -extfile server.cnf -extensions certificate_extensions -CA serverCA.pem -CAkey serverCA.pem -CAcreateserial -out servercert.pem Here we are creating a ServerCertificate which has the private key from serverreq.pem , signed by CA serverCA.pem using CA private key serverCA.pem The cert has the *public*key from the CSR, plus other information. It is signed by the CA's privatekey in serverCA.pem and is linked under the CA's certificate (matching that CA privatekey) also in serverCA.pem. (In many but not all cases, OpenSSL allows multiple things to be stored in one .pem file. Other programs may not.) $(CAT) servercert.pem serverkey.pem serverCAcert.pem rootcert.pem server.pem Not shure why we are doing here. Assuming serverCAcert.pem contains the same cert as serverCA.pem (but *not* the privatekey apparently also in serverCA.pem) and rootcert.pem contains the root cert over serverCAcert.pem, this puts the server's keypair, the cert for the server's key, the CA cert over the server's cert (called an intermediate or chain cert), and the root cert all in one file. Some servers (can) use a single file like that to define together the (server) key and cert with its chain they use for SSL/TLS handshake. Some clients do the same if you use client auth, but that is rarer. Technically the server doesn't need the root cert in this file. Any root supplied by the server to the client during handshaking is ignored; the client must use only a root configured locally. But if you want a record of what root the server cert chain uses, putting it in the file is a convenient and reliable way. Can some one explain me clearly above 3 commands. Also during Server Authentication , Server sends its certificate to the client which has the Public Key of the server. Here where is the Public Key generated? As above; the publickey in the server cert came from the CSR, which came from the server keypair generated and stored in the first step. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: doubt regarding certificate generation
From: owner-openssl-us...@openssl.org On Behalf Of Mithun Kumar Sent: Monday, 09 April, 2012 01:54 I am newbie to OpenSSL. I am trying to understand how certificates are generated. I downloaded the samples and started understanding the Makefile that came with the sources. FYI- this is *a* way of generating matching keys and certificates, which is what you need, in OpenSSL. There are other methods. Below is my understanding so far $(OPENSSL) req -newkey rsa:1024 -sha1 -keyout serverkey.pem -out serverreq.pem -config server.cnf -reqexts req_extensions Here we are trying to create a RSA private key with Private Key file serverkey.pem and output file serverreq.pem This creates an RSA key*pair* (private and public) which is stored in CRT format in serverkey.pem, *and* a certficate signing request aka CSR for the publickey half of that keypair in serverreq.pem. Although theoretical RSA public and private keys can be distinct with only (e,n) and (d,n), much better performance is obtained by the CRT implementation which stores e,d,n,p,q plus more. The publickey (e,n) is extracted from CRT format when needed. (CRT here means Chinese Remainder Theorem.) $(OPENSSL) x509 -req -in serverreq.pem -sha1 -extfile server.cnf -extensions certificate_extensions -CA serverCA.pem -CAkey serverCA.pem -CAcreateserial -out servercert.pem Here we are creating a ServerCertificate which has the private key from serverreq.pem , signed by CA serverCA.pem using CA private key serverCA.pem The cert has the *public*key from the CSR, plus other information. It is signed by the CA's privatekey in serverCA.pem and is linked under the CA's certificate (matching that CA privatekey) also in serverCA.pem. (In many but not all cases, OpenSSL allows multiple things to be stored in one .pem file. Other programs may not.) $(CAT) servercert.pem serverkey.pem serverCAcert.pem rootcert.pem server.pem Not shure why we are doing here. Assuming serverCAcert.pem contains the same cert as serverCA.pem (but *not* the privatekey apparently also in serverCA.pem) and rootcert.pem contains the root cert over serverCAcert.pem, this puts the server's keypair, the cert for the server's key, the CA cert over the server's cert (called an intermediate or chain cert), and the root cert all in one file. Some servers (can) use a single file like that to define together the (server) key and cert with its chain they use for SSL/TLS handshake. Some clients do the same if you use client auth, but that is rarer. Technically the server doesn't need the root cert in this file. Any root supplied by the server to the client during handshaking is ignored; the client must use only a root configured locally. But if you want a record of what root the server cert chain uses, putting it in the file is a convenient and reliable way. Can some one explain me clearly above 3 commands. Also during Server Authentication , Server sends its certificate to the client which has the Public Key of the server. Here where is the Public Key generated? As above; the publickey in the server cert came from the CSR, which came from the server keypair generated and stored in the first step. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: doubt regarding certificate generation
hi, The third command will just concatenate the key and certificate in one file. You can open server.pem and verify. Regards, Akash On Mon, Apr 9, 2012 at 11:23 AM, Mithun Kumar mithunsi...@gmail.com wrote: I am newbie to OpenSSL. I am trying to understand how certificates are generated. I downloaded the samples and started understanding the * Makefile* that came with the sources. Below is my understanding so far * $(OPENSSL) req -newkey rsa:1024 -sha1 -keyout serverkey.pem -out serverreq.pem -config server.cnf -reqexts req_extensions* Here we are trying to create a RSA private key with Private Key file serverkey.pem and output file serverreq.pem *$(OPENSSL) x509 -req -in serverreq.pem -sha1 -extfile server.cnf -extensions certificate_extensions -CA serverCA.pem -CAkey serverCA.pem -CAcreateserial -out servercert.pem* Here we are creating a ServerCertificate which has the private key from serverreq.pem , signed by CA serverCA.pem using CA private key serverCA.pem * $(CAT) servercert.pem serverkey.pem serverCAcert.pem rootcert.pem server.pem* Not shure why we are doing here. Can some one explain me clearly above 3 commands. Also during Server Authentication , Server sends its certificate to the client which has the Public Key of the server. Here where is the Public Key generated? Attachment has the MakeFile that i am referring to. -Thanks mithun
