Self-signed-certificate-with-custom-ca.md

on February 25, 2020 •

Adding custom root CA certificates to Debian is rather easy, but there are some non-obvious pitfalls that you might encounter. Here I’ve tried to collect most things to a single post for your convenience.

Adding Custom Root CA Certificates

But for claritys sake, I recommend that you create a subdirectory for each CA which makes things easier to keep track off.

sudo mkdir /usr/local/share/ca-certificates/my-custom-ca

Then copy your root CA certificate into the folder you just created.
Debian only supports certificates in the X509 form, aka. .crt, so if your certificate is in the .cer format, see my guide on how to convert it below.

sudo cp rootCA.crt /usr/local/share/ca-certificates/my-custom-ca/

Then you’ll need to run the update-ca-certificates command to make Debian load the certificates into it’s Trusted Root Certificate Store.

sudo update-ca-certificates

You should see an output similar to this

Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

Converting Certificates to .crt

Sometimes you’ll run into the problem that the root CA certificate that has been provided to you isn’t in the .crt format, but instead in the similar but not quite equivalent .cer format. Converting them is however quite easy using OpenSSL, just make sure that you use the full filepath for the .cer certificate.

openssl x509 -inform PEM -in <fullfilepath>/certificate.cert -out certificate.crt

Removing Custom Root CA Certificates

Removing your custom root CA certificate is even simpler, just delete the certificate from the folder you created earlier, and then ask Debian to update the CA certificate store, but completely this time

sudo update-ca-certificates --fresh

---

Categories: linux, Tech

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096

If you want a non password protected key just remove the -des3 option

Create and self sign the Root Certificate

openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt

Here we used our root key to create the root certificate that needs to be distributed in all the computers that have to trust us.

Create a certificate (Done for each server)

Create the certificate key

openssl genrsa -out mydomain.com.key 2048

Create the signing (csr)

The certificate signing request is where you specify the details for the certificate you want to generate.
This request will be processed by the owner of the Root key (you in this case since you create it earlier) to generate the certificate.

Important: Please mind that while creating the signign request is important to specify the Common Name providing the IP address or domain name for the service, otherwise the certificate cannot be verified.

I will describe here two ways to gener

Method A (Interactive)

If you generate the csr in this way, openssl will ask you questions about the certificate to generate like the organization details and the Common Name (CN) that is the web address you are creating the certificate for, e.g mydomain.com.

openssl req -new -key mydomain.com.key -out mydomain.com.csr

Method B (One Liner)

This method generates the same output as Method A but it’s suitable for use in your automation 🙂 .

openssl req -new -sha256 -key mydomain.com.key -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=mydomain.com" -out mydomain.com.csr

If you need to pass additional config you can use the -config parameter, here for example I want to add alternative names to my certificate.

openssl req -new -sha256 \
    -key mydomain.com.key \
    -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=mydomain.com" \
    -reqexts SAN \
    -config <(cat /etc/ssl/openssl.cnf \
        <(printf "\n[SAN]\nsubjectAltName=DNS:mydomain.com,DNS:www.mydomain.com")) \
    -out mydomain.com.csr

Verify the csr’s content

openssl req -in mydomain.com.csr -noout -text

Generate the certificate using the mydomain csr and key along with the CA Root key

openssl x509 -req -in mydomain.com.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out mydomain.com.crt -days 500 -sha256

Verify the certificate’s content

openssl x509 -in mydomain.com.crt -text -noout

How to add trusted Root-Certificates

How-to: Adding trusted root certificates to the SO (Win / MAC / Unix).

Feel totally free to edit this page to add another operating systems!

How-to list all available ssl CA certificates in Linux.

<div dir="auto" data-snippet-clipboard-copy-content="# Arch , Debian, Ubuntu
awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt

# Red-Hat, Fedora, CentOS
awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-bundle.crt

# Centos 5
awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)};{print | cmd}'

 Arch , Debian, Ubuntu
awk -v cmd=openssl x509 -noout -subject   /etc/ssl/certs/ca-certificates.crt

 Red-Hat, Fedora, CentOS
awk -v cmd=openssl x509 -noout -subject   /etc/ssl/certs/ca-bundle.crt

 Centos 5
awk -v cmd=openssl x509 -noout -subject   /etc/pki/tls/certs/ca-bundle.crt