Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a root self-signed CA which I've created for myself. With this CA (we'll call it country), I've created a server certificate and key for my webserver, nginx.

I now would like to create a second CA, state which will be used as my ssl_client_certificate CA in nginx. I'd like to keep state and country separated for various reasons and not use my root CA country for directly signing client certificates.

How can I generate a certificate authority state which is signed by country for authenticating client certificates in nginx?

share|improve this question
I personally use XCA for managing certs/keys. It's cross platform and allows tons of control. I don't like managing CAs through the openssl command line because it requires managing an openssl.cnf file (I much prefer specifying all args on the command itself). However there appears to be a nice writeup here. If you're interested in an answer for XCA, I can put one together. – Patrick Dec 2 '13 at 7:25
That's what I ended up doing. OpenSSL from the commandline is a bit of a nightmare if you're doing anything more advanced like managing a chain of certificates. Thanks for the tip, everything's now working. – Naftuli Tzvi Kay Dec 3 '13 at 7:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.