2.9. Creating a private key and a CSR for a TLS client certificate by using GnuTLS

Procedure

1. Generate a private key on your client system, for example:

   $ certtool --generate-privkey --sec-param High --outfile <example_client.key>

2. Optional: Use a text editor of your choice to prepare a configuration file that simplifies creating your CSR, for example:

   $ vim <example_client.cnf>
   signing_key
   encryption_key
   
   tls_www_client
   
   cn = "client.example.com"
   email = "client@example.com"

3. Create a CSR using the private key you created previously:

   $ certtool --generate-request --template <example_client.cfg> --load-privkey <example_client.key> --outfile <example_client.crq>

   If you omit the --template option, the certtool utility prompts you for additional information, for example:

   Generating a PKCS #10 certificate request...
   Country name (2 chars): <US>
   State or province name: <Washington>
   Locality name: <Seattle>
   Organization name: <Example Organization>
   Organizational unit name:
   Common name: <server.example.com>

Verification

1. Check that the human-readable parts of the certificate match your requirements, for example:

   $ certtool --certificate-info --infile <example_client.crt>
   Certificate:
   …
               X509v3 Extended Key Usage:
                   TLS Web Client Authentication
               X509v3 Subject Alternative Name:
                   email:client@example.com
   …