I am following this guide to create a Certificate Authority for internal use.
I am at the stage "Create the intermediate certificate" where the intermediate CA must be signed by the root CA.
openssl ca -config openssl.cnf -extensions v3_intermediate_ca \ -days 3650 -notext -md sha256 \ -in intermediate/csr/intermediate.csr.pem \ -out intermediate/certs/intermediate.cert.pem
Here, openssl.cnf points to the certificate I generated for the root CA.
[ CA_default ] private_key = $dir/private/ca-root.private.encrypted.key
OpenSSL then interactively throws this at me
Check that the request matches the signature Signature ok Certificate Details: Serial Number: 4096 (0x1000) Validity Not Before: Oct 21 17:12:48 2016 GMT Not After : Oct 31 17:12:48 2018 GMT Subject: [...snip...] X509v3 extensions: X509v3 Subject Key Identifier: EC:D9:FD:DC:AA:B9:D3:93:83:14:D2:4D:84:C6:75:A2:20:90:A1:E6 X509v3 Authority Key Identifier: keyid:EB:81:E3:6B:5D:32:DD:06:0A:D8:4F:B6:D0:5C:A2:BD:C9:CF:8E:79 X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign Certificate is to be certified until Oct 31 17:12:48 2018 GMT (740 days) Sign the certificate? [y/n]:
What am I looking for here? I snipped out the
Subject: section. Apart from eyeballing those details (they obviously match the stuff I created myself a minute a go), should I do anything else to check the certificate is valid?
And if the CSR came from a third party, what would I be looking to verify?