How to generate self-signed certificate for S/MIME with usage 'signing' only, like DOD uses

Question

I'm testing a feature to support S/MIME mail signing and encryption. As far as I know US DOD has quite strict standard on these certificates. So that DoD uses separate authentication, signing, and encryption keys. Also email address is placed not to "e-mail" field but somewhere else. Can anyone provide an example of how to create a set of test certificates similar to that?

Answer 1

Several of the OpenSSL utilities can add extensions to a certificate or certificate request based on the contents of a configuration file.

Key Usage

Key usage is a multi valued extension consisting of a list of names of the permitted key usages.

The supported names are: digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly and decipherOnly (meaning of each name I'll leave for you)

Extended Key Usage

This extensions consists of a list of usages indicating purposes for which the certificate public key can be used for.

These can either be object short names of the dotted numerical form of OIDs. While any OID can be used only certain values make sense. In particular the following PKIX, NS and MS values are meaningful

 Value                  Meaning
 -----                  -------
 serverAuth             SSL/TLS Web Server Authentication.
 clientAuth             SSL/TLS Web Client Authentication.
 codeSigning            Code signing.
 emailProtection        E-mail Protection (S/MIME).
 timeStamping           Trusted Timestamping
 msCodeInd              Microsoft Individual Code Signing (authenticode)
 msCodeCom              Microsoft Commercial Code Signing (authenticode)
 msCTLSign              Microsoft Trust List Signing
 msSGC                  Microsoft Server Gated Crypto
 msEFS                  Microsoft Encrypted File System
 nsSGC                  Netscape Server Gated Crypto