• OpenSslSelfSignedCertificate

Openssl Self Signed Certificate

• Nice instructions 201909 - https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/

2024 Azure AppGw with selfsigned CA

• Link: AppGW-SelfSigned-CA

• Create key

  export crt_ca_base="comtoso.ca"
  export crt_vm_base="fabrikam.vm"
  
  ## root ca cert - key, csr, self sign csr with key
  openssl ecparam -out ${crt_ca_base}.key -name prime256v1 -genkey
  openssl req -new -sha256 -key ${crt_ca_base}.key -out ${crt_ca_base}.csr
  # Complete info and password
  openssl x509 -req -sha256 -days 365 -in ${crt_ca_base}.csr -signkey ${crt_ca_base}.key -out ${crt_ca_base}.crt
  
  ## vm cert - key, csr, sign with ca_cert
  openssl ecparam -out ${crt_vm_base}.key -name prime256v1 -genkey
  openssl req -new -sha256 -key ${crt_vm_base}.key -out ${crt_vm_base}.csr
  openssl x509 -req -in ${crt_vm_base}.csr -CA  ${crt_ca_base}.crt -CAkey ${crt_ca_base}.key -CAcreateserial -out ${crt_vm_base}.crt -days 365 -sha256
  
  
  ## verify new vm cert
  openssl x509 -in ${crt_vm_base}.crt -text -noout
  
  ## verify server
  openssl s_client -connect localhost:443 -servername www.<<domain>>.co.nz -showcerts

Script 2024 generate .pfx with password

• Microsoft example

  PARENT="contoso.com"
  openssl req \
  -x509 \
  -newkey rsa:4096 \
  -sha256 \
  -days 3650 \
  -nodes \
  -keyout $PARENT.key \
  -out $PARENT.crt \
  -subj "/CN=${PARENT}" \
  -extensions v3_ca \
  -extensions v3_req \
  -config <( \
    echo '[req]'; \
    echo 'default_bits= 4096'; \
    echo 'distinguished_name=req'; \
    echo 'x509_extension = v3_ca'; \
    echo 'req_extensions = v3_req'; \
    echo '[v3_req]'; \
    echo 'basicConstraints = CA:FALSE'; \
    echo 'keyUsage = nonRepudiation, digitalSignature, keyEncipherment'; \
    echo 'subjectAltName = @alt_names'; \
    echo '[ alt_names ]'; \
    echo "DNS.1 = www.${PARENT}"; \
    echo "DNS.2 = ${PARENT}"; \
    echo '[ v3_ca ]'; \
    echo 'subjectKeyIdentifier=hash'; \
    echo 'authorityKeyIdentifier=keyid:always,issuer'; \
    echo 'basicConstraints = critical, CA:TRUE, pathlen:0'; \
    echo 'keyUsage = critical, cRLSign, keyCertSign'; \
    echo 'extendedKeyUsage = serverAuth, clientAuth')
  
  openssl x509 -noout -text -in $PARENT.crt
  
  
  # To get a .pfx, use the following command:
  openssl pkcs12 -export -out $PARENT.pfx -inkey $PARENT.key -in $PARENT.crt

• Bash script on Mac

  set -e
  
  export gencert_key=key.pem
  
  # Create a key
  openssl genrsa -out key.pem 2048
  
  # Create certifcate signin request
  openssl req -new -sha256 -key key.pem -out csr.csr
  # enter whatever information you wish, good practice to include a password
  
  # Create certificate
  openssl req -x509 -sha256 -days 3650 -key key.pem -in csr.csr -out certificate.pem
  
  # Convert to .pfx file
  openssl pkcs12 -export -inkey key.pem -in certificate.pem -out certificate.pfx 
  
  # Create DER-encoded CER file
  openssl x509 -inform PEM -in certificate.pem -outform DER -out certificate.cer
  
  # Get Fingerprint
  # its important to note the -inform, that's the format.
  
  openssl x509 -noout -fingerprint -sha1 -inform dec -in certificate.cer

Example 2019, create self signed certificate with keyUsage flags

• openssl req -out test.csr -newkey rsa:4096 -nodes -keyout test.key -config cert.cnf
• openssl x509 -req -days 3650 -in test.csr -signkey test.key -sha256 -out test.crt
• cert.cnf

  • [ req ]
    default_bits       = 4096
    distinguished_name = req_distinguished_name
    
    x509_extensions = v3_req
    
    [ req_distinguished_name ]
    countryName                 = Country Name (2 letter code)
    countryName_default         = NZ
    stateOrProvinceName         = State or Province Name (full name)
    stateOrProvinceName_default = Auckland
    
    localityName                = Locality Name (eg, city)
    localityName_default        = Auckland
    organizationName            = Organization Name (eg, company)
    organizationName_default    = Infra&Networks
    commonName                  = Common Name (e.g. server FQDN or YOUR name)
    commonName_max              = 64
    commonName_default          = test.vigor,nz
    
    [v3_req]
    
    basicConstraints = CA:FALSE
    keyUsage = keyEncipherment, digitalSignature, nonRepudiation
    extendedKeyUsage = serverAuth, clientAuth
    
    subjectAltName = @alt_names
    
    [alt_names]
    DNS.1   = test1.vigor.nz