I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring all the necessary software, I wanted to post this question as a sanity check.
Please correct me if any of the following are not true:
- OpenSSL is a compiled (probably C/C++) library that I can download onto my linux server; it will then give me command-line tools that I can call from external applications or directly at the terminal
- The Java
keytool
can be used to generate CSRs and private keys that will be needed by OpenSSL - To obtain an SSL certificate through OpenSSL, I start by using
keytool
to generate the CSR, and then, somehow (probably as an argument?), pass that CSR on to OpenSSL through the command-line interface
Again, if any of these are false, please begin by correcting me!
Now then, assuming I am on the right track, I have one major concern with this method:
Although a free option, wouldn't this mean that any web browser attempting to connect to my server over HTTPS would not recognize my CA cert and throw a nasty warning message my end users?
If not, please explain why. If so, then one solution I was hoping to explore was a situation where I buy my primary SSL certificate from a commercial provider (Verisign, Trustwave, GeoTrust, whoever) and then somehow use OpenSSL to "branch off" from that cert for all of my sub-domains.
The goal here is to get several SSL certs on the cheap, but still have them be authentic and thus trusted by my end user's browsers.
Any chance this is a possibility or will I have to go through a commercial vendor?