I have a root self-signed CA which I've created for myself. With this CA (we'll call it country), I've created a server certificate and key for my webserver, nginx.

I now would like to create a second CA, state which will be used as my ssl_client_certificate CA in nginx. I'd like to keep state and country separated for various reasons and not use my root CA country for directly signing client certificates.

How can I generate a certificate authority state which is signed by country for authenticating client certificates in nginx?

  • 2
    I personally use XCA for managing certs/keys. It's cross platform and allows tons of control. I don't like managing CAs through the openssl command line because it requires managing an openssl.cnf file (I much prefer specifying all args on the command itself). However there appears to be a nice writeup here. If you're interested in an answer for XCA, I can put one together. – Patrick Dec 2 '13 at 7:25
  • That's what I ended up doing. OpenSSL from the commandline is a bit of a nightmare if you're doing anything more advanced like managing a chain of certificates. Thanks for the tip, everything's now working. – Naftuli Kay Dec 3 '13 at 7:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.