- SSL Configurations for Intermediate certificate
- How to add my own created certificate authority to system trusted repositories
Why I can't find a page which tell me what's the kind of openssl extensions?!
I was doing Mutual Authentication and then when I wanted to put an intermediate certificate in the process I discovered that the generated and signed intermediate
CA is self-signed because of the option
I read the man pages and found this relevant:
Basic Constraints. This is a multi valued extension which indicates whether a certificate is a CA certificate. For example:
Key Usage : Key usage is a multi valued extension consisting of a list of names of the permitted key usages. The supported names are:
digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly and decipherOnly.
keyUsage=digitalSignature, nonRepudiation keyUsage=critical, keyCertSign
I have seen a
critical and non critical in the browser certificate view. My certificates don't have those fields. I also read that when there's no extension, that means your certificate is considered as root and self-signed certificate.
I want to make four different kinds of certificates:
rootca > serverca > server crt signed by server ca && client crt signed by server ca
In documentation I came across these:
v3_ca , v3_user , v3_ca
Are those the answer of my question?
My commands to generate intermediate ca and sign it with
rootca key are:
openssl genrsa -out $keyfile $keysize; openssl req -new -key $keyfile -out $reqfile -passin pass:$pw \ -subj "/C=$country/ST=$state/L=$location/O=$org/CN=$name" 2>&1; openssl x509 -req -days $days -in $reqfile -out $certfile \ -signkey $cakeyfile 2>&1;
I don't use a configuration file because I'm running all of this operations from a bash script.
I wonder if anyone can give me an explanation of the extension and if could put them as arguments and not getting them from bash (because it will need to open the bash script and edit it for every call to my bash).