{"id":535,"date":"2021-02-06T07:00:00","date_gmt":"2021-02-06T15:00:00","guid":{"rendered":"https:\/\/tungle.ca\/?p=535"},"modified":"2023-01-06T21:40:08","modified_gmt":"2023-01-07T05:40:08","slug":"create-your-own-certificate-authority-ca-in-linux","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=535","title":{"rendered":"Create Your Own Certificate Authority (CA) in Linux"},"content":{"rendered":"\n<p>A certificate authority (CA) issues digital certificates that certify the ownership of a public key by the named subject of the certificate. <\/p>\n\n\n\n<p>Below are a couple of steps to install self-signed trusted Root CA on a Linux server.<\/p>\n\n\n\n<p>Step #1: Install openssl<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>yum install openssl<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-83.png\" alt=\"\" class=\"wp-image-536\" width=\"557\" height=\"129\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-83.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-83-300x70.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-83-768x179.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-83-200x47.png 200w\" sizes=\"auto, (max-width: 557px) 100vw, 557px\" \/><\/figure>\n\n\n\n<p> Step #2: Creating your own CA<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/etc\/pki\/CA\/private\/\nopenssl genrsa -aes128 -out ourCA.key 2048<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-84.png\" alt=\"\" class=\"wp-image-537\" width=\"555\" height=\"119\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-84.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-84-300x64.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-84-768x165.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-84-200x43.png 200w\" sizes=\"auto, (max-width: 555px) 100vw, 555px\" \/><\/figure>\n\n\n\n<p>Now create a Certificate Authority (CA) certificate using the&nbsp;ourCA.key.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl req -new -x509 -days 1825 -key \/etc\/pki\/CA\/private\/ourCA.key -out \/etc\/pki\/CA\/certs\/ourCA.crt<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-85.png\" alt=\"\" class=\"wp-image-538\" width=\"562\" height=\"242\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-85.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-85-300x130.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-85-768x332.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-85-200x86.png 200w\" sizes=\"auto, (max-width: 562px) 100vw, 562px\" \/><\/figure>\n\n\n\n<p>Next, create a local wildcard certificate (*.linuxlab.local) on your own CA.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl genrsa -out \/etc\/pki\/tls\/private\/wildcard-cert.key 2048<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-86.png\" alt=\"\" class=\"wp-image-539\" width=\"563\" height=\"125\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-86.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-86-300x67.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-86-768x172.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-86-200x45.png 200w\" sizes=\"auto, (max-width: 563px) 100vw, 563px\" \/><\/figure>\n\n\n\n<p>Now, generate a CSR (Certificate Signing Request) for the wildcard cert.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl req -new -key \/etc\/pki\/tls\/private\/wildcard-cert.key -out \/etc\/pki\/tls\/wildcard.csr<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-87.png\" alt=\"\" class=\"wp-image-540\" width=\"571\" height=\"301\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-87.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-87-300x158.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-87-768x406.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/01\/image-87-200x106.png 200w\" sizes=\"auto, (max-width: 571px) 100vw, 571px\" \/><\/figure>\n\n\n\n<p>Using WinSCP to download a local Root CA self-signed public-key certificate to a Windows machine. Then, import it into the GPO of the Windows domain or any Windows\/Linux\/Mac web browser.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A certificate authority (CA) issues digital certificates that certify the ownership of a public key by the named subject of the certificate. Below are a couple of steps to install self-signed trusted Root CA on a Linux server. Step #1: Install openssl Step #2: Creating your own CA Now create a Certificate Authority (CA) certificate [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,11],"tags":[8],"class_list":["post-535","post","type-post","status-publish","format-standard","hentry","category-linux","category-security","tag-linux"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=535"}],"version-history":[{"count":3,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/535\/revisions"}],"predecessor-version":[{"id":2632,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/535\/revisions\/2632"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}