In this video, you'll learn how to create self-signed certificates.
So PKI certificates are commonly used in Linux services.
And to secure resources like web servers, it's essential to understand how certificates
are working.
To use public keys, they need to be signed by a certificate authority, and self-signed
certificates are an easy way to get started with your own certificates.
And as just mentioned, it's perfectly acceptable to use them if you are using them internally
only.
And these certificates can next be used in different services that need a TLS encrypted
channel, for instance.
Now let me demonstrate how to do this.
So first, I walk you through the demo.
And you need to understand that this demo consists of different steps.
Step number one is where you create the certificate authority, because self-signed certificates
are all about certificates that are signed, and signing takes place by the certificate
authority.
I'll later tell you about the commands.
Next step is to create the certificate.
So you need to create a private key and generate a certificate request from it.
In case you are wondering what is this between the double quotes, well, that is how you can
easily recognize the required commands in the man page, as I will show you in a bit.
So the certificate is extracted from a private key, and once you have extracted the certificate
signing request from the private key, you can self-sign the certificate.
So when you generate a public-private key pair, you create certificate signing requests,
and that is what you send to the certificate authority, and that is going to do the signing
for you.
And that is how it works.
Let me show you so that we can see the result.
So I'm going to create these certificates in a dedicated directory, so mkdir openSSL.
It's in my home directory, and that's okay.
I just want a safe location where I can work with this.
Then I'm going to use the openSSL command.
There are some easy-to-use front-end commands, but the easy-to-use front-end commands all
go back to openSSL.
They're distribution-specific, which is why I don't like them.
Better invest your time in understanding openSSL.
Gen RSA to generate an RSA key.
Minus-3, which is the encryption algorithm, and minus-out is specifying the output, and
the output is myca.key.
And 2048 is the number of bits that I'm using for this key.
So what you generate here is a private key, and the encryption algorithm makes it you
can use it as a certificate authority private key.
Now you need PAMP passphrase, and this passphrase is what you are going to use whenever you
need to use the private key.
So the certificate authority private key is used for signing of public key certificates,
and you should protect that because this is secure business, and that is why in this case
I'm entering a passphrase.
Now I'm using openSSL REC for a request, minus-X509, that's the X509 certificate, minus-new.
We want a new one.
No DES.
We don't need DES encryption.
Minus-key, myca.key, minus-char256 for the algorithm, minus-DES3650, that's the validity,
and minus-out, myca.PAMP.
So what is this doing?
Well, this is going to create the certificate authority certificate, and that is what you
are going to hand out to the clients.
An important parameter is minus-DES3650.
The certificate authority certificate typically is valid for a long period because if it expires,
all the certificates that it has signed will expire as well.
Now we need to enter the passphrase.
That's the passphrase for the certificate authority private key, and now it is asking
me more information about it.
Now for the CA, it's not essential, but it's good practice to include the information.
But if it's internal only, feel free to enter on all requests because these parts of information
are used for verification purposes.
It's relevant on the internet.
For a self-signed certificate, it's not that relevant.
Now I'm going to create a private key and generate a certificate request from it.
So at this point, we have the MyCA key and the MyCA PAM, which means that we have the
certificate authority key material.
So now let's create a private key for use in a server.
Open SSL, gen RSA, minus out, TLS.key, 2048.
So once again, we generate a private key, and the only difference with the private key
used by the CA is that we don't use DES3 algorithm, but it's still a private key.
From the private key, we are going to extract the certificate signing request.
So open SSL, rec for request, minus new.
So new request, minus key, TLS.key, minus out, TLS.CSR.
That is the certificate signing request, and that is what you are going to sign later.
Now while creating the certificate signing request, you need at least to enter a common name.
The country name, the state, the locality, that doesn't matter too much.
What matters is the common name, because the common name is the name of your server host.
So let's call it linuxplus.example.com.
Think about this carefully, because this certificate is going to be used by the server,
and if the certificate name does not match the name of the user, then the client will reject it.
So this is very important information.
The rest of the information is all optional.
So now we have the certificate signing request, and we can go over to step three.
And step three is where we are going to use the certificate authority to sign the certificate request,
and that is openSSL, x509, minus rec, minus in, TLS.CSR.
So we put the certificate signing request in, minus CA.
That's an identifier of the certificate authority.
And this certificate authority is just identified by its public key certificate,
but we also need access to the CA private key.
Now, the CA needs to create a serial number for its own administration,
and minus out is specifying what it is going to create.
So it creates TLS.CRT.
Minus days, 1650.
That's the validity of the request.
And you need to make sure that it will be valid throughout the lifetime of the certificate authority public key certificate.
And finally, minus SHA256 for the encryption algorithm.
Oh, and did I make a mistake?
Yeah, I made a mistake.
My mistake is in the CA, minus CA key.
Minus CA key needs the argument myCA.key.
And now we can see that it is doing all right.
We can see the common name, and it's asking for the passphrase.
That is a certificate authority passphrase that I've used before.
So I'm going to enter it, and the result is that now I have a TLS.CRT.
That is the public key certificate that will be handed out to the clients,
and the TLS.key, that is the private key that I can use on my server itself.
Now, the procedure that we have just gone through is a complex procedure.
So I want you to understand what to do.
So I've created some slides with all the commands where I'm going to tell you what it is doing.
So first, we were using OpenSSL GenRSA.
GenRSA is a generic part that generates the private key.
DES3 is the encryption algorithm,
which is recommended for the certificate authority because it's relatively strong.
And out generates an output file.
Next step was OpenSSL REC minus X.509.
So the REC argument calls the PKCS10 certificate request
and certificate generating utility.
So OpenSSL always works with specific subcommands,
and REC is what we are using here.
X.509 produces a self-signed certificate instead of a CSR,
which is a certificate signing request.
New generates a new request.
NODES ensures that if a private key is created, it is not encrypted.
KEY specifies the file to read the key from.
SHA256 is used to generate secured hashes,
and DASE specifies the validity of the certificate in DASE.
And .PAM is a self-signed PAM file,
a file that can be used to distribute a complete certificate chain,
and which is a common standard in cryptography.
Now, notice that the example generate a self-signed root certificate also works.
Have a look at man OpenSSL-REC,
and this combines this step with the previous step.
Next, we have used the OpenSSL genRSA minus out TLS.key,
which will generate a private key to be used by your server.
From that private key, we have extracted the certificate signing request,
and minus out is the name of the certificate signing request.
And very important is the common name.
It needs to match the host name that is going to use the certificate.
And you can find these commands in the man page as well.
If you use man OpenSSL-REC,
look at create a private key and generate a certificate request from it.
You don't have to memorize all of this.
If you have system access, the man page of OpenSSL-REC is quite specific.
Last step was OpenSSL-X509, where X509 is assigning utility.
REC tells OpenSSL that we need to create a request.
In is for the input file.
CA and CA-key are identifying the certificate authority keys.
CA creates a serial.
It's a mandatory option that will create the CA serial number.
Out is a certificate that is going to be produced.
DASE is the validity, and SHA-256 is the hashing algorithm.
And you can also find this information in man OpenSSL-X509
in signer certificate request using the certificate extensions.
And that is how you can create your own self-assigned public-private certificate pair.
And you can use them internally on your web service, for instance.