1. SSL Configurations for Intermediate certificate
  2. How to add my own created certificate authority to system trusted repositories

Why I can't find a page which tell me what's the kind of openssl extensions?!

I was doing Mutual Authentication and then when I wanted to put an intermediate certificate in the process I discovered that the generated and signed intermediate CA is self-signed because of the option -sign-key.

I read the man pages and found this relevant:

Basic Constraints. This is a multi valued extension which indicates whether a certificate is a CA certificate. For example:


Key Usage : Key usage is a multi valued extension consisting of a list of names of the permitted key usages. The supported names are:

   digitalSignature, nonRepudiation, keyEncipherment, 
   dataEncipherment, keyAgreement, keyCertSign, cRLSign, 
   encipherOnly and decipherOnly.


    keyUsage=digitalSignature, nonRepudiation
    keyUsage=critical, keyCertSign

I have seen a critical and non critical in the browser certificate view. My certificates don't have those fields. I also read that when there's no extension, that means your certificate is considered as root and self-signed certificate.

I want to make four different kinds of certificates:

rootca > serverca > server crt signed by server ca && client crt signed by server ca

In documentation I came across these:

v3_ca , v3_user , v3_ca

Are those the answer of my question?

My commands to generate intermediate ca and sign it with rootca key are:

openssl genrsa -out $keyfile $keysize;

openssl req -new -key $keyfile -out $reqfile -passin pass:$pw \
-subj "/C=$country/ST=$state/L=$location/O=$org/CN=$name" 2>&1;

openssl x509 -req -days $days -in $reqfile -out $certfile \
-signkey $cakeyfile 2>&1;


I don't use a configuration file because I'm running all of this operations from a bash script.

I wonder if anyone can give me an explanation of the extension and if could put them as arguments and not getting them from bash (because it will need to open the bash script and edit it for every call to my bash).

1 Answer 1


In a nutshell: basicConstraints=CA:TRUE/FALSE

Says whether the certificate is a certificate of a CA. Only authority can issue a certificate.

keyUsage attribute says what is permitted to do with the certificate. You can, for example, issue a certificate just for signing emails. If you used such a certificate in an web server (to identify the server to clients) the result should be certificate isn't taken as valid - because intended use was for signing emails not for identifying a website. (there would be of course different CNs but if they weren't it would work just the way I described).

Solution to your problem:

rootca - some self-signed certificate

serverca - ca certificate (basicConstraints=CA:TRUE) signed by rootca

servercrt,clientcrt - ordinary CSRs signed by serverca

When you sign some certificate as a certificate authority, you should use: openssl ca -CA authority.crt -CAkey authority.key ... other options are like -config,-set_serial,-days,...

I never actually used CA without its configuration file so that will probably answer somebody else. I think it should be possible to input all parameters on the command line.

You can, however, create more configuration files (one for each authority) and supply them in the -config parameter. The advantage of this approach is that you will get archive of all issued crts, automatic increment of serial numbers, ...

  • Thanks so much for replaying , I had read that ca command shouldn't be used for production environments . and in man page , in BUGS section you can read so . what's the best command for doin this ? x509 !? Commented May 9, 2013 at 7:11
  • I don't see what is really bad on openssl ca .... According to the manpages it is possible to use openssl x509 ... which I tried but I gave up sortly after :). It is possible to get man pages of openssl subcommands by invoking man <subcommand>.
    – Fiisch
    Commented May 10, 2013 at 18:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .