How can I create and use self signed server certificate?

Question

In development of a web service, I can use self signed server certificate for testing under HTTPS. How can we make a client (possibly run in the same host, but maybe a different host) work with the service in HTTPS?

On Ubuntu 18.04, I try to run a gRPC service in ASP.NET Core. https://stackoverflow.com/a/59702094 says

On Ubuntu the standard mechanism would be:

• dotnet dev-certs https -v to generate a self-signed cert
• convert the generated cert in ~/.dotnet/corefx/cryptography/x509stores/my from pfx to pem using openssl pkcs12 -in <certname>.pfx -nokeys -out localhost.crt -nodes
• copy localhost.crt to /usr/local/share/ca-certificates
• trust the certificate using sudo update-ca-certificates
• verify if the cert is copied to /etc/ssl/certs/localhost.pem (extension changes)
• verify if it's trusted using openssl verify localhost.crt

Does it only mention about creating and self signing a server certificate for a service, but not setting up for a client? I heard that a browser will warn about self signed server certificates, so wondering how to prepare a web service client to handle self signed server certificates?

Can dotnet dev-certs https -v be replaced with some general command which doesn't depend on .NET Core? Note: dotnet dev-certs https -v actually doesn't work on Ubuntu, but only on Windows and Mac. See the link for workaround.

Thanks.

Answer 1

If you're just trying to get trusted certs for local Web development that browsers won't reject, this works pretty well:

create a directory called [www.mysecuredomain.com] (make that custom to your project)

paste the following into a file named host.conf inside the directory:

[req]

default_bits       = 2048
default_keyfile    = server.key
distinguished_name = req_distinguished_name
req_extensions     = req_ext
x509_extensions    = v3_ca

[req_distinguished_name]

countryName                 = Country Name (2 letter code)
countryName_default         = US
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = [Your State Name Here]
localityName                = Locality Name (eg, city)
localityName_default        = [Your City Name Here]
organizationName            = Organization Name (eg, company)
organizationName_default    = [Your Org Name Here]
organizationalUnitName      = organizationalunit
organizationalUnitName_default = [ Your Org Unit Here ]
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_default          = [ www.mydevdomain.com ]
commonName_max              = 64

[req_ext]

subjectAltName = @alt_names

[v3_ca]

subjectAltName = @alt_names

[alt_names]
DNS.1   = [ www.mydevdomain.com ]

throw this in a shell file (example: create-trusted-cert.sh) above the directory you just created:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout "./$1/server.key" -out "./$1/server.crt" -config "./$1/host.conf"
certutil -d sql:$HOME/.pki/nssdb -D -n $1
certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n "$1" -i "./$1/server.crt"
certutil -d sql:$HOME/.pki/nssdb -L | grep "$1"

type this at the commanline:

> ./create-trusted-cert.sh [www.mysecuredomain.com]

Be sure to modify the values in the directory, host.conf and command line args to fit your project.
Happy developing.