This topic has been discussed multiple times here and all over web & I did follow most of it but looks like my fundamentals are not strong enough to get thru...
Here is a quick snap of requirement and the steps I have taken
Create a key pair [pvt/pub], let's call this use case as MYKEY
Generate x509 cert from MYKEY
Before sharing this x509 cert, establish a chain of custody but there is no root CA available. Going out in the market is not an option.
This cert must now be signed using another private key, let's say, MYMASTERKEY and since pub portion of MYMASTERKEY will be shared with recipient, it establishes a chain of custody.
Share the signed cert with the recipient.
What have I done:
Generated RSA2048 key. Could easily extract pub key as well as created a csr [called MYKEY.csr] from pvt key [MYKEY].
Could generate x509 cert directly from pvt key but I don't think that's the requirement here.
Created another pvt key called MYMASTERKEY. Could extract its pub key as well as its self signed cert. I am going to treat MYMASTERKEY as my root CA here.
Generated csr for MYKEY [
openssl req -new -key MYKEY.pem -out MYKEYCSRREQ.pem]. Used this syntax to 'supposedly' sign this csr using MYMASTERKEY [
openssl x509 -req -days 730 -in MYKEYCSRREQ.pem -signkey MYMASTERKEY.pem -out MYKEYX509.crt]
Where am I stuck?
I am not sure if MYKEYX509.crt is what I should share with my recipient. I am not sure about the syntax I am using although it looks correct. Also I am lost to check if I can verify MYKEYX509.crt using pub key of MYMASTERKEY. What would be the syntax here as root CA is my own ?
Also, when I open MYKEYX509.crt using
openssl x509 -in MYKEYX509.crt -noout -text,the issuer details are not from root CA [in my case, MYMASTERKEY]. This confuses me. On one hand, it looks like I am doing the right thing but I am not able to verify and do not feel confident about it.