Openssl Cert Signing

Question

This topic has been discussed multiple times here and all over web & I did follow most of it but looks like my fundamentals are not strong enough to get thru...

Here is a quick snap of requirement and the steps I have taken

1. Create a key pair [pvt/pub], let's call this use case as MYKEY

2. Generate x509 cert from MYKEY

3. Before sharing this x509 cert, establish a chain of custody but there is no root CA available. Going out in the market is not an option.

4. This cert must now be signed using another private key, let's say, MYMASTERKEY and since pub portion of MYMASTERKEY will be shared with recipient, it establishes a chain of custody.

5. Share the signed cert with the recipient.

What have I done:

1. Generated RSA2048 key. Could easily extract pub key as well as created a csr [called MYKEY.csr] from pvt key [MYKEY].

2. Could generate x509 cert directly from pvt key but I don't think that's the requirement here.

3. Created another pvt key called MYMASTERKEY. Could extract its pub key as well as its self signed cert. I am going to treat MYMASTERKEY as my root CA here.

4. Generated csr for MYKEY [openssl req -new -key MYKEY.pem -out MYKEYCSRREQ.pem]. Used this syntax to 'supposedly' sign this csr using MYMASTERKEY [openssl x509 -req -days 730 -in MYKEYCSRREQ.pem -signkey MYMASTERKEY.pem -out MYKEYX509.crt]

Where am I stuck?

I am not sure if MYKEYX509.crt is what I should share with my recipient. I am not sure about the syntax I am using although it looks correct. Also I am lost to check if I can verify MYKEYX509.crt using pub key of MYMASTERKEY. What would be the syntax here as root CA is my own ?

Also, when I open MYKEYX509.crt using openssl x509 -in MYKEYX509.crt -noout -text,the issuer details are not from root CA [in my case, MYMASTERKEY]. This confuses me. On one hand, it looks like I am doing the right thing but I am not able to verify and do not feel confident about it.

Answer 1

Have you created a CA Singing Certificate for your CA? That is the step where you specify the details of your root CA, which will appear in all certificates that this CA creates. This answer is basically a digest of these somewhat terse instructions for setting up your CA that I found on google.

So it looks like before your CA can produce any signed certs, you need to create both a CA signing key (your MYMASTERKEY) and a CA self-signed certificate based on MYMASTERKEY (I think this is what you're missing):

The following command will ask you all sorts of questions about your CA - the information that will appear in certs that it signs - and then it generates the self-signed CA Signing Certificate CAcert.crt:

openssl req -new -key MYMASTERKEY.pem -x509 -days 1095 -out CAcert.crt

Once you have "configured" your CA by creating a CA signing cert, then you can take your client's Certificate Singing Request file (*.csr) and create a cert from it:

openssl x509 -req -days 365 -in MYKEYREQ.csr -CA CAcert.crt -CAkey MYMASTERKEY.pem -CAcreateserial -out clientCert.crt

The resulting clientCert.crt is what you give back to the client for them to install in their webserver, use to sign email, wtv.

---

Just for completeness for future readers, here's the steps that a client would have to take in order to submit a certificate request to the CA:

1- Generate a key

openssl genrsa -des3 -out <new.key> 2048

2- Generate a certificate signing request

openssl req -new -key <new.key> -out <new.csr>

The <new.csr> file is what you send to the CA to be made into a certificate. Note that the above command will ask you all sorts of questions about the organization or domain that you are requesting the certificate for. If you are planning to submit this to a public CA, then you will want to think carefully about what to put in there.