SSL Certificate 101

How to generate a self-signed certificate

If you wish to generate a certificate from an actual Certificate Authority then the flow is done like such:

I will only be explaining how to generate a self-signing certificate because the process is essentially the same, except that you abstract out the CA as a thirty party that will handle the request for you automatically.

To create create a self-signed certificate (a certificate that's signed by a CA that YOU own) this is the steps:

1. Create your own root CA certificate and root CA private key

To get started with creating self-signed certificate you will need to first create your root CA private key and root CA certificate.

Running the following command will generate a private key and name the file as server.key to indicate that this is the private key for the server.

openssl genrsa -out root.key

To generate the root CA certificate run the following command:

openssl req -x509 -days 365 -key root.key -out root.cer

This will generate a root certificate with the server private key that's valid for 365 days. You can validate this certificate by running and you can see the expiration date of this certificate.

openssl x509 -in root.cer -text

Note that you must provide a common name field in order to validate the certificate trust chain.

2. Create your server private key and certificate signing request

Go ahead and generate your server's private key with the following command.

openssl genrsa -out server.key

Now then you will need to create a certificate signing request with your server's private key.

openssl req -new -key server.key -out server.csr

When prompted to enter in a common name field you will also need to enter it in otherwise, you cannot validate the certificate trust chain.

3. Use CSR to create server certificate

The following command will use the certificate signing request (who to sign the certificate for) and the root server's certificate information and the private key to create a server certificate signed by the root CA hosted by ourselves.

openssl x509 -req -in server.csr -CA root.cer -CAkey root.key -CAcreateserial -out server.crt -days 365

4. Validate certificate chain

Finally, to validate that the output server certificate is indeed created and signed by the root server we can run the following command:

openssl verify -CAfile root.cer server.crt

If everything is good, then you should see the output server.crt: OK

What is Self-Signed Certificate

All root CA certificates are self-signed in the sense that the root CA certificate is created using the certificate's own private key. Nothing special about them besides that the organization owns them are a trusted entity by the general public and have good reputation in owning and issuing out certificates.

You can also generate your own self-signed certificate.

What is PEM files

https://origin-blog.mediatemple.net/work-life/ssl-certificate-101-everything-you-need-to-know/

• What is PEM files
• What is X.509 file types
• How the hell does certificate work