mbedtls/programs/ssl/CA-HOWTO.txt

                How to setup your own Certificate Authority
                ===========================================


Note: this howto requires the openssl binary, as well as classic
UNIX tools (cat, touch, echo). If you use Windows, please consider
installing Cygwin -- see http://cygwin.com/


    1. Configure OpenSSL
    --------------------

First of all, create sslconf.txt in the current directory
(a basic example is provided at the end of this file).

cat > sslconf.txt <<"EOF"
[paste contents here]
EOF

Then you need to create the database and a starting serial number:

touch index
echo "01" > serial
mkdir newcerts


    2. Generate the CA certificate
    ------------------------------

openssl req -config sslconf.txt -days 3653 -x509 -newkey rsa:2048 \
            -set_serial 0 -text -keyout test-ca.key -out test-ca.crt


    3. Generate the private keys and certificate requests
    -----------------------------------------------------

openssl genrsa -out server1.key 2048
openssl genrsa -out server2.key 2048
openssl genrsa -out client1.key 2048
openssl genrsa -out client2.key 2048

openssl req -config sslconf.txt -new -key server1.key -out server1.req
openssl req -config sslconf.txt -new -key server2.key -out server2.req
openssl req -config sslconf.txt -new -key client1.key -out client1.req
openssl req -config sslconf.txt -new -key client2.key -out client2.req


    4. Issue and sign the certificates
    ----------------------------------

openssl ca -config sslconf.txt -in server1.req -out server1.crt
openssl ca -config sslconf.txt -in server2.req -out server2.crt
openssl ca -config sslconf.txt -in client1.req -out client1.crt
openssl ca -config sslconf.txt -in client2.req -out client2.crt


    5. To revoke a certificate and update the CRL
    ---------------------------------------------

openssl ca -config sslconf.txt -revoke server1.crt
openssl ca -config sslconf.txt -revoke client1.crt
openssl ca -config sslconf.txt -gencrl -out crl.pem


    6. To display a certificate and verify its validity
    ---------------------------------------------------

openssl x509 -in server2.crt -text -noout
cat test-ca.crt crl.pem > ca_crl.pem
openssl verify -CAfile ca_crl.pem -crl_check server2.crt
rm ca_crl.pem


    7. To export a certificate into a .pfx file
    -------------------------------------------

openssl pkcs12 -export -in client2.crt -inkey client2.key \
                      -out client2.pfx


##================================================================
##============== Example OpenSSL configuration file ==============
##================================================================

#  References:
#
#  /etc/ssl/openssl.conf
#  http://www.openssl.org/docs/apps/config.html
#  http://www.openssl.org/docs/apps/x509v3_config.html

[ ca ]
default_ca              = my_ca

[ my_ca ]
certificate             = test-ca.crt
private_key             = test-ca.key
database                = index
serial                  = serial

new_certs_dir           = newcerts
default_crl_days        = 60
default_days            = 730
default_md              = sha1
policy                  = my_policy
x509_extensions         = v3_usr

[ my_policy ]
countryName             = optional
stateOrProvinceName     = optional
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
distinguished_name      = my_req_dn
x509_extensions         = v3_ca

[ my_req_dn ]
countryName             = Country Name..............
countryName_min         = 2
countryName_max         = 2
stateOrProvinceName     = State or Province Name....
localityName            = Locality Name.............
0.organizationName      = Organization Name.........
organizationalUnitName  = Org. Unit Name............
commonName              = Common Name (required)....
commonName_max          = 64
emailAddress            = Email Address.............
emailAddress_max        = 64

[ v3_ca ]
basicConstraints        = CA:TRUE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer:always

[ v3_usr ]
basicConstraints        = CA:FALSE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer