Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a root self-signed CA which I've created for myself. With this CA (we'll call it country), I've created a server certificate and key for my webserver, nginx.

I now would like to create a second CA, state which will be used as my ssl_client_certificate CA in nginx. I'd like to keep state and country separated for various reasons and not use my root CA country for directly signing client certificates.

How can I generate a certificate authority state which is signed by country for authenticating client certificates in nginx?

share|improve this question
2  
I personally use XCA for managing certs/keys. It's cross platform and allows tons of control. I don't like managing CAs through the openssl command line because it requires managing an openssl.cnf file (I much prefer specifying all args on the command itself). However there appears to be a nice writeup here. If you're interested in an answer for XCA, I can put one together. –  Patrick Dec 2 '13 at 7:25
    
That's what I ended up doing. OpenSSL from the commandline is a bit of a nightmare if you're doing anything more advanced like managing a chain of certificates. Thanks for the tip, everything's now working. –  Naftuli Tzvi Kay Dec 3 '13 at 7:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.