I am following this guide to create a Certificate Authority for internal use.

I am at the stage "Create the intermediate certificate" where the intermediate CA must be signed by the root CA.

openssl ca -config openssl.cnf -extensions v3_intermediate_ca \
  -days 3650 -notext -md sha256 \
  -in intermediate/csr/intermediate.csr.pem \
  -out intermediate/certs/intermediate.cert.pem

Here, openssl.cnf points to the certificate I generated for the root CA.

[ CA_default ]
private_key = $dir/private/ca-root.private.encrypted.key

OpenSSL then interactively throws this at me

Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 4096 (0x1000)
            Not Before: Oct 21 17:12:48 2016 GMT
            Not After : Oct 31 17:12:48 2018 GMT
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
            X509v3 Authority Key Identifier: 

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
Certificate is to be certified until Oct 31 17:12:48 2018 GMT (740 days)
Sign the certificate? [y/n]:

What am I looking for here? I snipped out the Subject: section. Apart from eyeballing those details (they obviously match the stuff I created myself a minute a go), should I do anything else to check the certificate is valid?

And if the CSR came from a third party, what would I be looking to verify?


Check ... signature / Signature ok tells you that the openssl program checked the CSR signature and made sure it verifies, before doing anything else. You don't need to check the signature, and it wouldn't be practical to. ca then displays just the subject name by default, or most of the details if name_opt and/or cert_opt is configured as you apparently have, and unless you use -batch you are asked whether to sign (issue) the proposed certificate or not.

For a CSR you generated yourself, you presumably trust yourself (unless you are Michael Garibaldi), so approve. If the CSR came from a third party, best practice is to check it out before running ca, because the most important thing to check is whether the requester is legitimate and authorized which you can't do from just the CSR (or cert) contents, so again just approve. But if you didn't check it yet, this is your last opportunity to:

  • check subject and optionally SAN appropriately identifies the party; or for simple hierarchical X.500 cases (which aren't nearly as common as CCITT hoped) you can configure policy to automatically check subject DN against issuer DN

  • if you copied extensions from the CSR, which is not the default, check they describe capabilities you want to 'certify' for this party; if you used extensions from your config file(s) you can doublecheck there's no mistake there (even if you did check the CSR)

  • perhaps check the subject-key algorithm and size meet any security and interoperability requirements for your environment and/or this party

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.