Setup Your Own Certificate Authority (CA) on Linux and Use it in a Windows Environment by VirtuallyHyper ~ Dons Deals

This how to article, is very detailed and could be used for info on setting up a CA on your Self Hosted Web site too...

Don

Setup Your Own Certificate Authority (CA) on Linux and Use it in a Windows Environment

Posted by Karim Elatov on April 21, 2013 Leave a comment (0) Go to comments

In this previous post, I deployed a test IIS Server and used a self signed SSL Certificate to encrypt the HTTP traffic. I am sure everyone have seen this page in Internet Explorer:

When I clicked “View Certificate”, I saw the following:

We can see that certificate is issued by the same entity as the site-name itself. We can also see that the Root CA is not trusted. Since this is a self-signed Certificate, you are the Root CA in a manner of speaking. My goal is to get rid of that message and to become a “trusted” Certificate Authority (CA) in my local Windows Environment.

Choosing a free Certificate Authority software

If we take a look at this wikipedia page, we will see the following list of available software:

DogTag

EJBCA

gnoMint

OpenCA

OpenSSL, which is really an SSL/TLS library, but comes with tools allowing its use as a simple certificate authority.

r509

XCA

There is actually one more that I ran into, it’s called tinyCA.

Using OpenSSL Commands to Setup a CA

DogTag, EJBCA, and OpenCA were full blown Public-Key Infrastructure (PKI) applications and I didn’t need all of the extra functionally. There are a lot of examples on how to setup your own CA with openssl:

I have done that before and when you are managing a lot of different certificates the process is not very scalable. Also, if you don’t keep doing it, you have to re-trace your steps to remember how the setup works. There is also a Perl script that is included to ease the CA setup, that script is called CA.pl. Depending on your Linux distribution you have find the right package that contains that script. Here is where I found it on my Fedora install:

[elatov@klaptop ~]$ yum provides "*/CA.pl*"  Loaded plugins: langpacks, presto, refresh-packagekit, remove-with-leaves  1:openssl-perl-1.0.1c-7.fc18.x86_64 : Perl scripts provided with OpenSSL  Repo        : fedora  Matched from:  Filename    : /etc/pki/tls/misc/CA.pl  Filename    : /usr/share/man/man1/CA.pl.1ssl.gz

You can check out examples from “Setup your own Certificate Authority” and Becoming a CA Authority on how to use the Perl script; here is a very high level overview:

#Generate CA Certificate  CA.pl -newca    #Generate a Certificate Signing Request (CSR)  CA.pl -newreq    #Sign the CSR with your CA key  CA.pl -sign

TinyCA

Certificate Authority (CA)

: Linux Today - How to Run Your Own Certificate Authority; How to Run Your Own Certificate Authority - eSecurity Planet; Linux Today - Setup Your Own Certificate Authority (CA) on Linux and Use it in a Windows Environment; Setup Your Own Certificate Authority (CA) on Linux and Use it in a Windows Environment | VirtuallyHyper

Dons Deals

Thursday, 25 April 2013