curl -k https:/www.test.com -v –-key key.pem –-cacert ca.pem –-cert client.pem
-k allows insecure connections，makes everything here insecure
PKI – Public key infrastructure
CA – Certificate Authority
CSR – Certificate signing request
SSL – Secure Socket Layer
TLS – Transport Layer Security
Root CA – Root Certificate Authority Certificate (Public)
3 types of SSL Certificates.
Self Signed SSL
SSL from Trusted Certificate Authorities
SSL signed by own Certificate Authority
generates a private key and certificate
private.key certificate.crt
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout private.key -out certificate.crt
req - Command passed to OpenSSL intended for creating and processing certificate requests usually in the PKCS#10 format.
-x509 - This multipurpose command allows OpenSSL to sign the certificate somewhat like a certificate authority. X.509 refers to a digitally signed document according to RFC 5280.
-sha256 - This is the hash to use when encrypting the certificate.
-nodes - This command is for no DES, which means that the private key will not be password protected.
-days - The number of days that the certificate will be valid.
-newkey - The format of the key, in this case an RSA key with 4096 bit encryption.
-keyout - The location to output the private key of the self-signed certificate.
-out - The location to output the certificate file itself.
verify that it is correct according to the parameters that we have set
openssl x509 -in certificate.crt -text -noout
x509 - This is a multipurpose command, and when combined with the other parameters here, it is for retrieving information about the passed in the certificate.
-in - The certificate that we are verifying.
-text - Strips the text headers from the output.
-noout - Needed not to output the encoded version of the certificate
create certificate signing requests for requesting a certificate from a certificate authority that is trusted.
equest.csr
openssl req -new -newkey rsa:2048 -nodes -out request.csr -keyout private.key
this command generates a CSR.
You will notice that the -x509, -sha256, and -days parameters are missing.
By leaving those off, we are telling OpenSSL that another certificate authority will issue the certificate.
In this case, we are leaving the -nodes option on to not prompt for a password with the private key.
verify that the CSR is correct
openssl req -in request.csr -text -noout -verify
Generate the CA private key file.
ca.key
openssl genrsa -out ca.key 2048
Generate CA x509 certificate file using the CA key
ca.crt
openssl req -x509 -new -nodes -key ca.key -sha256 -days 1825 -out ca.crt
openssl req -x509 -new -nodes -key ca.key -subj "/CN=scriptcrunch/C=US/L=CALIFORNIA" -days 1825 -out ca.crt
Create a server private key
openssl genrsa -out server.key 2048
Create a configuration file named csr.conf for generating the Certificate Signing Request (CSR)
cat > csr.conf <<EOF
[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
C = US
ST = California
L = San Fransisco
O = Scriptcrunch
OU = Scriptcrunch Dev
CN = scriptcrunch.com
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = scriptcrunch
DNS.2 = scriptcrunch.com
IP.1 = 10.34.12.5
IP.2 = 10.34.12.5
EOF
Generate the CSR using the private key and config file
openssl req -new -key server.key -out server.csr -config csr.conf
Generate the server SSL certificate using ca.key, ca.crt and server.csr
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key
-CAcreateserial -out server.crt -days 10000
-extfile csr.conf
https://scriptcrunch.com/create-ca-tls-ssl-certificates-keys/