How do I create my own Certificate Authority (CA)

CA is short for Certificate Authority. A CA issues certificates for i.e. email accounts, web sites or Java applets. Actually this only expresses a trust relationship. If you trust the CA then you automatically trust all the certificates that have been issued by the CA. This article helps you set up your own tiny CA using the OpenSSL software.

Common web browsers already “ship” with a number of CAs. That means you usually trust companies like Verisign, AOL and Microsoft. (Do you really?) If you like to see which CAs are currently trusted:

  • Mozilla Firefox: Edit / Preferences / Advanced / Certificates / Manage Certificaes / Authorities
  • Internet Explorer: Extras / Internet options / Content / Certificates / Trusted Root CAs

Your own CA

Certificates usually do not come for free. An excellent exception is the first free CA: CaCert. Currently not all browsers have their certificate built in. Microsoft only seems to trust CAs if they pay an unrealistic amount of money – who’s surprised? It is worth spreading the word since this CA is about trust instead of money.

Otherwise having a valid certificate for your server often just means that you spend money to big companies called trust centers. But perhaps you just need a certificate (i.e. for your private web server running HTTPS at home) and do not really care whether the CA is contained in other people’s browsers. Then you should consider creating your own CA. The only difference is that your clients will get a warning when contacting your server that the CA is not (yet) trusted. This can be either safely ignored or you can make them install your CA’s certificate. It is also a good solution if you need a company-wide CA.

First you need to to install OpenSSL. On Debian this means running apt-get install openssl. Go to the directory where you want to create the files that make up the CA. Next type: /usr/lib/ssl/misc/CA.pl -newca

The script will create a new directory named demoCA. The CA’s private key (keep it safe!) and the public key/certificate (which you may need to give to your clients) will be put there. The public certificate is the demoCA/cacert.pem file. It does not matter really what you enter into the fields. Just pick a meaningful name for the common name field so that it’s clear you are looking at a CA – not a person. So name it “ACME Lasagna Certifiate Authority” instead of “Peters Blaphemic’s Fun Certificate”. Pick something that sounds official.

Notice: the CA has an expiry date. The default setting is one year. You may want to edit the file CA.pl and set Days to ten years.

Create a certificate

Now that you have your own CA you can create certificates for servers. That means you have to do two steps:

  • Your “client” creates a private key (.key) and a certificate request (.req):
    /usr/lib/ssl/misc/CA.pl -newreq

  • You sign that request with your CA’s key and create a certificate (.crt) that you send to the client:
    /usr/lib/ssl/misc/CA.pl -sign

Note: If your “client” does not send you a certificate request you can create all the necessary files for them.

To simplify things you may want to use my script makecert that you can use to quickly create new certificates for i.e. Apache SSL servers. Run it like this:

./makecert mailserver.mydomain.com

You will get three files:

  • mailserver.mydomain.com.key (the client’s private key)
  • mailserver.mydomain.com.req (the client’s certificate request)
  • mailserver.mydomain.com.crt (the client’s signed certificate)

The certificate request is just an intermediate file that is not necessary to run a server using that certificate. You just need the private key and the certificate.

If you like to use that certificate for an Apache web server you need to put the private key (.key) and the certificate (.crt) into the same file and call it apache.pem.

Example:

cat mailserver.mydomain.com.key mailserver.mydomain.crt > apache.pem

Sign a request

Some server create a certificate request (SAP, IIS). You will get that request as a file from the client. Use the following command on that request file:

ca -policy policy_anything -notext -in clients.server.com.req -days 3650 -out clients.server.com.crt

Some tricks

Show all information about a certificate:

openssl x509 -noout -text < crt

Calculate the MD5 fingerprint of a certificate:

openssl x509 -noout -fingerprint < crt

Calculate the SHA1 fingerprint of a certificate:

openssl x509 -sha1 -noout -fingerprint < crt

The ‘makecrt’ script

#
# Create SSL certificates
# Christoph Haas <email@christoph-haas.de>
#

DAYS=3650
OUTFILE=$1-apache.pem

if [ -z "$1" ]; then
echo "Usage: $0 [host.domain]"
exit 10
fi

echo "Creating certificate for host $1"

(
echo "My Country"
echo "My Region"
echo "My City"
echo "My Company"
echo "My Department"
echo $1
echo "webmaster@$1"
echo
echo
) |
openssl req -new -nodes -keyout $1.key -out $1.req -days $DAYS
openssl ca -policy policy_anything -notext -days $DAYS -out $1.crt -infiles $1.req
chmod go= $1.crt $1.key $1.req

31 thoughts on “How do I create my own Certificate Authority (CA)”

  1. Mike Dunphy

    Thanks for the script, However I am still getting the infamous message that there is a problem w/ the my websites security for the https site I am serving up despite giving it this signed certificate in the apache config

    Any ideas on how to fix that ?

    Reply
      1. Mike Dunphy

        Ah that was it … for some reason I was thinking that SSLCACertificateFile pointer in the apache would do it
        BTW … firefox worked w/o importing CA cert as trusted
        Thanks Again !!!

        Reply
        1. booi

          It’s pretty troubling that that worked without importing the root CA cert. You should have to.

          Reply
          1. Savagedlight

            The first browser probably installed it as a system-trusted certificate. I.e. any application on that system would trust it.

  2. Rost

    Hello! I keep getting error: /usr/lib/ssl/misc/CA.pl is an invalid command. How can i fix it? I already tried to type it few times to avoid typing mistake.

    Reply
    2. david

      Hi,
      first you have to install openssl-perl
      yum install openssl-perl

      then try in the followin path:
      /etc/pki/tls/misc
      ./CA.pl

      Reply
  3. Alberto

    I can’t generate wildcard domains with your script. It renames “*” to “_”.
    For example: ./makecert “*.mydomain.com”

    Reply
    1. FreiIT

      Use single quotes

      You might have a file named ‘_’ in your directory and the bash replaces this before the actual call to ‘./makecert’

      Reply
  4. Roee

    Hello and thanku for the article

    I need Linux CA server for lab testing .
    I would like to enroll my cisco router to retreive certificates from the server for Ipsec tunnel .

    Does the above is sufficient configuration for installing new CA server ?

    thanks
    ROee

    Reply
  5. paul

    The certificate production works fine, but I notice it’s a 1024 bit key, when the industry is now moving to 2048.

    In spite of searching on-line and not really coming up with anything remotely as straight forward as this article, does anyone know how to use this method and tool to produce a 2048 strength key please?

    Reply
    1. Christoph Haas

      Thanks for the hint. I have started revising this article and will come up with more explanations and an upgrade to 4096 bits in the next weeks.

      Reply
  6. Chad Antonio

    Hi,

    Would like to drop a question.

    If you have created a CA server, do you need to maintain it and keep it available once you have issued a certificate to other servers?

    Reply
    1. Konrad

      There is no such thing like a CA server. It’s math that tells the browser if a certificate is signed by a CA.

      Reply
  7. Anmol Singh

    Hi,
    I am new to SSL Certificate world so, can you just contact me privately & teach me a step by step guide for becoming a Certificate Authority like other & provide SSL as CA Provider.
    Thanks…!

    Reply
  11. Anu

    I am getting an error “unable to load CA private key 5105:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: ANY PRIVATE KEY” . How to sort out a solution for this? Can you help me?

    Reply
  12. hilojack

    Is there any way to change output directory?

    $ cd ~;
    $ /etc/pki/tls/misc/CA -newca;
    touch: cannot touch `/etc/pki/CA/index.txt’: Permission denied

    Reply
  13. Shravan

    Hi Thanks for the information.

    When I try to run /usr/lib/ssl/misc/CA.pl -sign, I get the following error –
    Using configuration from /usr/lib/ssl/openssl.
    unable to load CA private key
    140636460418720:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY
    Signed certificate is in newcert.pem

    oncuelinx@oncuelinx-ThinkPad-T520:~$ echo $SSLEAY_CONFIG
    -config /usr/lib/ssl/openssl.cnf

    Am I missing something ?

    Reply
    1. Christoph Haas

      You are getting asked a couple of questions like which country you are from or how your organisation is called. That information will be included in the CA certificate but will have no technical effect.

      Reply
  15. saeb

    I wanna choose a MA proposal about improving inside and outside of company network. here everyone believes to Conspiracy Theory . so i wanna start research about can we use CA s which made by ourselves everywhere or not. do u think it worth for MA proposal?

    Reply
  16. sharath

    hi,

    So i want to setup a self-signed CA on a linux machine which serves multiple clients. and each of these clients use the certificate to authenticate each other. after generating csr at client side how can i connect to the CA(via sockets) and send csr to receive certificate?

    Reply
    1. Christoph Haas

      Do you often just google for something, click the first hit and ask for something completely unrelated no matter what the actual site deals with?

      Reply
  18. Mike Lieberman

    OK, so I am confused. I can run all the way to:
    /usr/lib/ssl/misc/CA.pl -sign

    And it works… No errors. BUT I get a file named newkey.pem.

    There is no “req” file. My mailserver needs a CSR file.

    I found how to generate a crt file from the pem:
    openssl x509 -outform der -in newcert.pem -out my-file.crt

    It works.
    BUT I can’t get to a CSR file. There is a key, inside the PEM files, careq.pem, cacert.pem, newreq.pem, and clearly newkey.pem. I tried renaming newkey.pem to my-file.key. I tried extracting the keys from all the other pems and naming them key… nothing worked. Here is the command (before I edited the key name).

    openssl x509 -x509toreq -in my-file.crt -out my-file.csr -signkey myfile.key

    Here is the result:
    unable to load certificate
    140457369646744:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE

    So does anyone have an idea? I thought the whole point what that this made my server… trusted.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top