1

I'm use to creating self-signed certificates for local use via: 

openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out  certificate.pem
openssl pkcs12 -inkey key.pem -in certificate.pem -export -out certificate.p12

Today after a long meeting I have been asked to create a standard self-signed certificate with a CLR Distribution point with no root ca. I always created certificates with a CRL DP based on CA. How would you generate a CRL after creating a self-signed certificate with no CA? Is this even possible?

Improve this question
2
  • 1
    Certificates don't contain CRLs. They contain the address of a CRL distribution point. Or at least, that's what I've seen.
    – AlexP
    Nov 7, 2017 at 22:35
  • 1
    Sorry, i meant the CRL Distribution point. I'm not even sure how you would add one to a self-signed cert nor create the CRL that would be at the DP. I'll update my question.
    – user156514
    Nov 7, 2017 at 22:39

1 Answer 1

Reset to default
4

When signing your certificate, use the extfile option, where you should specify a file containing something like the following:

crlDistributionPoints=URI:http://example.com/crl.pem

To get to that, instead of creating a certificate directly with openssl, create a csr (use the -new option with openssl req) and key, then generate the certificate following this example (using your own filenames and parameters, if desired):

openssl x509 -req -in cert.csr -out cert.pem -signkey key.pem -extfile crlfile.ext

You can verify the end result with:

openssl x509 -in cert.pem -noout -text

As a side note, this doesn't make sense to improve security. Such a CRL would need to be signed with the same key as the certificate, so that if the key is compromised, a new, clean, crl can be created and considered valid from the same compromised key.

To create a CRL with openssl you are supposed to use its CA functions, as described here. The difference would be that the CA key would be your cert key, and the revoked cert would be the certificate itself. As you can see, this was not supposed to work this way, even if you end up with a self signed certificate with a CDP, and a "valid" crl that is, actually, invalidating itself as by revoking the certificate that signed it.

Improve this answer
2
  • 1
    You don't need to split req -new / x509 -req -signkey to get extensions; req -new -x509 does extensions from a config section selected either on command line with -extensions or in config file with x509_extensions=section (while x509 -req has only command line not config file). (Note a CSR not cert created with req -new (not -x509) is slightly different.) Concur with main point CRLDP (also OCSP) for a root is useless.
    – dave_thompson_085
    Nov 8, 2017 at 10:28
  • @Zip Thanks for the overview, same set up I was about to implement. The security issues I agree with, I can argue till I'm blue in the face with management and they do not see a problem. @ Dave_thomspon_085 I have never tried the cmd line options before. Thanks for the pointer.
    – user156514
    Nov 8, 2017 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.