1

If my understanding is correct, a CA acts like a parent certificate that is used to verify other certificates that have been signed by the CA certificate without having to install multiple server certificates for web services such as a FTP server, web server, Nextcloud, OpenVPN server etc?

I'm trying to create a CA certificate that I can distribute to my local network and onto friends' over a WAN so that when they and try and access one of my services it will be safe to connect to. For example instead of giving them several certificates for each service I'm hosting I can just give them one, the CA certificate.

Each server certificate is obliviously signed by the CA so by having the one CA certificate installed on their machine this will automatically verify the server certificates because it was signed using the CA in the first place. Correct?

Problem is today I tried to install the CA certificate on to my Windows client PC and tried accessing my OpenMediaVault GUI over HTTPS and I'm still getting a unsecure warning screen.

The code block below shows the entire creation process of the CA and server certificates. I will include a screenshot of the directory tree so you can see all the files and folders. I will also include the contents of the configurations files

My Guide

# Make OpenSSL Directory
mkdir ~/Desktop/OpenSSL

# Make Child Directories
mkdir -p ~/Desktop/OpenSSL/{ca,configs,"csr's",keys}

# Change Directory Into OpenSSL Directory
cd ~/Desktop/OpenSSL

# Create CA Certificate
openssl req -x509 -newkey rsa:4096 -keyout ca/cakey.pem -out ca/cacert.pem -days 3650 -sha256 -nodes -config configs/ca_openssl.cnf

# Create serial file
echo '01' > serial

# Create index.txt
touch index.txt

##
### Create server certificates ###
##

# OpenMediaVault
openssl genrsa -out keys/OpenMediaVault.pem 4096
openssl req -new -key keys/OpenMediaVault.pem -config configs/openmediavault_openssl.cnf -out "csr's"/OpenMediaVault.csr

# OpenWrt
openssl genrsa -out keys/OpenWrt.pem 4096
openssl req -new -key keys/OpenWrt.pem -config configs/openwrt_openssl.cnf -out "csr's"/OpenWrt.csr

##
### Sign Server Certificates With CA ###
##

# OpenMediaVault
openssl x509 -req -CA ca/cacert.pem -CAkey ca/cakey.pem -in "csr's"/OpenMediaVault.csr -out certificates/OpenMediaVault.crt -extfile configs/openmediavault_openssl.cnf -extensions v3_req -CAserial serial

# OpenWrt
openssl x509 -req -CA ca/cacert.pem -CAkey ca/cakey.pem -in "csr's"/OpenWrt.csr -out certificates/OpenWrt.crt -extfile configs/openwrt_openssl.cnf -extensions v3_req -CAserial serial

# Convert PEM to CRT
openssl x509 -outform der -in ca/cacert.pem -out "My Custom CA".crt

# Convert PEM to PKCS12
openssl pkcs12 -export -out certificate.pfx -inkey ca/cakey.pem -in ca/cacert.pem -certfile CACert.crt

'ca_openssl.cnf'

[ ca ]
default_ca    = CA_default        # The default ca section

[ CA_default ]
dir                   = ~/Desktop/"OpenSSL Certificates"
certs               = $dir/certs
crl_dir               = $dir/crl
database           = $dir/index.txt
new_certs_dir       = $dir/newcerts
certificate        = $dir/cacert.pem
serial             = $dir/serial
crlnumber          = $dir/crlnumber
cr                 = $dir/crl.pem
private_key        = $dir/private/cakey.pem

[ req ]

# Don't prompt for the Domanin Name (DN). Use configured values instead.
# This Saves having to type in your DN each time.

prompt              = no
string_mask         = default
distinguished_name  = req_distinguished_name
x509_extensions     = v3_ca

# The size of the key in bits
default_bits    = 4096

[ req_distinguished_name ]
countryName             = GB
stateOrProvinceName     = SOME_PROVINCE
localityName            = SOME_CITY
organizationName        = domain
organizationalUnitName  = domain
commonName              = domain Certificate Authority
emailAddress            = user@domain.com

[ v3_ca ]
# Extensions added to the request

basicConstraints = critical, CA:TRUE
keyUsage =         critical, keyCertSign, cRLSign

'openmediavault_openssl.cnf'

[ req ]

# Don't prompt for the Domanin Name (DN). Use configured values instead.
# This Saves having to type in your DN each time.

prompt              = no
string_mask         = default
distinguished_name  = req_distinguished_name
req_extensions      = v3_req

# The size of the key in bits
default_bits    = 4096

[ req_distinguished_name ]
countryName             = GB
stateOrProvinceName     = SOME_PROVINCE
localityName            = SOME_CITY
organizationName        = OpenMediaVault
organizationalUnitName  = OpenMediaVault
commonName              = OpenMediaVault.local

[ v3_req ]
# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alternative_names

[ alternative_names ]
DNS.0   = domain.com
IP.0    = 192.168.1.123

'openwrt_openssl.cnf'

[ req ]
# Don't prompt for the Domanin Name (DN). Use configured values instead.
# This Saves having to type in your DN each time.

prompt              = no
string_mask         = default
distinguished_name  = req_distinguished_name
req_extensions      = v3_req

# The size of the key in bits
default_bits    = 4096

[ req_distinguished_name ]
countryName             = GB
stateOrProvinceName     = SOME_PROVINCE
localityName            = SOME_CITY
organizationName        = OpenWrt
organizationalUnitName  = OpenWrt
commonName              = OpenWrt.local

[ v3_req ]
# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alternative_names

[ alternative_names ]
DNS.0   = domain.com
IP.0    = 192.168.1.1

Directory Tree

I installed the 'OpenMediaVault.crt' from the '/certificates' directory and 'OpenMediaVault.pem' from the '/keys' directory.

The 'certificate.pfx' file is the result from the last command in the 'My Guide' section and was imported into Windows certmgr. I used the 'My Custom CA.crt' file with Firefox's certification options.

What am I doing wrong?

Many thanks

Will

UPDATE 1

I think I have found the cause of the problem. When I access https://openmediavault.local (which is the common name set in the certificate) I get this message "The certificate is only valid for the following names:" The two shown in my screen (one blurred out for privacy) are the subjectAltNames I added. Why do the alternative names work but the CN doesn't? I accessed it from https://192.168.1.123 and I have a green padlock in my Firefox address bar. enter image description here

UPDATE 2

Just to let you know I added the CN into the subjectAltName and everything works perfectly.

As a side question related to OpenSSL, I'm now hoping to make some OpenVPN certificates. Can the CA made with OpenSSL sign my OpenVPN certificates?

0

Yes, if the SAN (subject alternative name) extension is present, browsers won't look at the CN anymore. This is specified in RFC 2818 sect. 3.1, Chrome started enforcing this about two years ago (Chrome 58), Firefox did the same for publicly-issued certificates about three years ago (Firefox 48). I don't know if Firefox still has exceptions for private CAs. (Good job debugging that issue yourself, btw!)

Anyway, you'll have to re-issue your certificates with all names that you want to use in the SubjectAltNames.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.