Setting Up a Root Certificate Authority with OpenSSL

~ Tom's IT Cafe

In secure communication establishing a secure channel is very important. One way to achieve this is by setting up a Root Certificate Authority (CA) to sign and manage digital certificates. In this article, we’ll guide you through the process of creating your own Root CA and signing service certificates using OpenSSL, a versatile open-source tool for cryptography.

If you want to discuss the topic with other technology-minded people, join my Discord: https://discord.gg/YbSYGsQYES

Now we have an IRC channel as well: irc.libera.chat / #tomsitcafe

Install OpenSSL

Before diving into the intricacies of certificate creation, ensure that OpenSSL is installed on your system. You can download it from the official OpenSSL website or use your operating system’s package manager for installation.

Create the Root CA

The Root CA serves as the trust anchor for all certificates in your infrastructure. Follow these steps to generate the Root CA key and certificate:

  1. Generate the private key for the Root CA:
   openssl genpkey -algorithm RSA -out rootCA.key
  1. Create the Root CA certificate:
   openssl req -x509 -new -key rootCA.key -out rootCA.crt

Provide the necessary information when prompted. This creates the foundation of trust for your entire certificate hierarchy.

Create the Service Key and Certificate Signing Request (CSR)

Now, let’s generate the key for your service and create a Certificate Signing Request (CSR):

  1. Generate the private key for your service:
   openssl genpkey -algorithm RSA -out service.key
  1. Create a CSR for your service:
   openssl req -new -key service.key -out service.csr

Enter the requested details to build the CSR, which will be submitted to the Root CA for signing.

Sign the Service Certificate with the Root CA

The next step involves signing the CSR with the Root CA to produce a valid service certificate:

  1. Sign the CSR with the Root CA:
   openssl x509 -req -in service.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out service.crt -days 365

Adjust the certificate validity period according to your needs. This command ensures that your service certificate is signed by the trusted Root CA.

Verify the Certificates

To ensure the integrity and correctness of the generated certificates, use the following commands:

  1. Verify the Root CA certificate:
   openssl x509 -noout -text -in rootCA.crt
  1. Verify the Service certificate:
   openssl x509 -noout -text -in service.crt

These commands provide a detailed view of the certificates, confirming their validity and correctness.

Utilize the Certificates in Your Application

Integrate the generated service.key and service.crt into your application to enable secure communication. Remember to safeguard the Root CA key (rootCA.key) as compromising it would jeopardize the entire security infrastructure.

In conclusion, establishing a Root CA and signing service certificates using OpenSSL lays the groundwork for a secure and trustworthy communication environment. Tailor the certificate details and durations to align with your specific requirements, and always adhere to best practices for security in production environments.

Building a secure foundation is not a one-time task; regular updates, monitoring, and adherence to security best practices are essential for maintaining a robust security posture.

If you want to discuss the topic with other technology-minded people, join my Discord: https://discord.gg/YbSYGsQYES

Now we have an IRC channel as well: irc.libera.chat / #tomsitcafe

Leave a comment