Setup a CA
$/usr/lib/ssl/misc/CA.sh -newca
CA certificate filename (or enter to create)
Making CA certificate ...
Generating a 1024 bit RSA private key
....++++++
....++++++
writing new private key to ‘./demoCA/private/./cakey.pem’
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
-------
Country Name (2 letter code) UK:
State or Province Name (full name) West Midlands:
Locality Name (eg, city) []:Birmingham
Organization Name (eg, company) Internet Widgits Pty Ltd:Private CA
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:Private Certifiacte Authority
Email Address []:hostmaster@website.com
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/./cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Nov 14 19:39:58 2010 GMT
Not After : Nov 13 19:39:58 2013 GMT
Subject:
countryName = UK
stateOrProvinceName = West Midlands
organizationName = Private CA
commonName = Private Certifiacte Authority
emailAddress =
X509v3 extensions:
X509v3 Subject Key Identifier:
18:CA:B2:08:0B:59:F2:25:FF:81:CD:1E:B3:0E:4E:FC:F3:08:C8:87
X509v3 Authority Key Identifier:
keyid:18:CA:B2:08:0B:59:F2:25:FF:81:CD:1E:B3:0E:4E:FC:F3:08:C8:87
DirName:/C=UK/ST=West Midlands/O=Private CA/CN=Private Certifiacte Authority/emailAddress=hostmaster@website.com
serial:00
X509v3 Basic Constraints:
CA:TRUE
Certificate is to be certified until Nov 13 19:39:58 2013 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
This creates ./demoCA directory (defined under CA_default in openssl.cnf) with CA database files:
$ ls demoCA
cacert.pem certs index.txt index.txt.attr.old newcerts serial
careq.pem crl index.txt.attr index.txt.old private serial.old
Index.txt is the certificate database:
$ cat demoCA/index.txt
V 131113193958Z 00 unknown /C=UK/ST=West Midlands/O=Private CA/CN=Private Certifiacte Authority/emailAddress=hostmaster@website.com
V 111114194449Z 01 unknown /C=UK/ST=West Midlands/L=Birmingham/O=Private Website/CN=webmail.website.com/emailAddress=hostmaster@website.com