Page History

# Generate Root Certificate Authority (CA) Private Key
openssl ecparam -name prime256v1 -genkey -noout -out root-ca.key

# Generate Root CA Certificate
openssl req -new -x509 -sha256 -days 5475 -key root-ca.key -out root-ca.crt

# You are about to be asked to enter information that will be incorporated
# into your certificate request.
# What you are about to enter is what is called a Distinguished Name or a DN.
# There are quite a few fields but you can leave some blank
# For some fields there will be a default value,
# If you enter '.', the field will be left blank.
# -----
# Country Name (2 letter code) [XX]:DE
# State or Province Name (full name) []:Berlin
# Locality Name (eg, city) [Default City]:Berlin
# Organization Name (eg, company) [Default Company Ltd]:SOS
# Organizational Unit Name (eg, section) []:JS7
# Common Name (eg, your name or your server's hostname) []:JS7 Deployment CA
# Email Address []:

# Specify server for which the certificate should be created
server=somehost

# Step 1 - Generate Private Key and Certificate Signing Request
openssl req -new -config openssl-cert.config -extensions 'standard exts' -nodes \
    -days 73005475 -newkey rsa:4096 -keyout ${server}.key -out ${server}.csr

# Step 2 - Generate and sign the Server Certificate
openssl x509 -req \
    -in ${server}.csr \
    -CA root-ca.crt \
    -CAkey root-ca.key \
    -CAcreateserial \
    -out ${server}.crt -days 7300 \
    -extfile <(printf 'subjectAltName=DNS:%s\nnsCertType = client, server\nkeyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth, clientAuth\n' "${server}")