3

I have a LAN HTTPS server that I want to give an SSL certificate to. Since it's local-only, a self-signed certificate is sufficient for me. I have previously given it a self-signed root certificate, which has worked fine.

However, if the key of that root certificate is stolen, an attacker can sign certificates for e.g. www.google.com, and my computer (not everyone's) would trust it (since it trusts the self-signed root certificate), and visit the attacker's website instead. And I would not be able to notice this.

Therefore I want to create a self-signed certificate that can only be used by the server to prove it's identity. So even if my computer trusts that certificate, it won't trust certificates signed by that certificate.

Preferably I want to use this one-liner I recently found:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

but modify it to limit the key usage, to take into account what I wrote above.

I found these key usages and extended key usages from a tutorial. Will they achieve what I want?

keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
  • 1
    Create a local CA, sign your site certificate with it and delete the CA key – Sefa Mar 18 at 13:02
  • That would work fine as long as the site certificate doesn't get the key usage that allows it to further sign certificates. Is it possible to let the CA not have those key usages directly? – arcus_mannen Mar 18 at 13:18
  • A CA is a self signed certificate and by definition must sign at least a certificate (itself) so i don't think it's possible to have a CA (or self signed cert) without the signature usage. Morover, if someone manage to get the key of your certificate you probably have other problem – Sefa Mar 18 at 13:25
  • KU critical should do it but for belt-and-suspenders add basicConstraints=critical,CA:FALSE – dave_thompson_085 Mar 19 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.