Appendix B. OpenSSL Certificate Reference

Procedure B.1. Create a Private Key

• Use this command to generate a 1024-bit RSA private key with file encryption. If the key file is encrypted, the password will be needed every time an application accesses the private key.

  # openssl genrsa -des3 -out mykey.pem 1024
  

  Copy to Clipboard Toggle word wrap
  Use this command to generate a key without file encryption:

  # openssl genrsa  -out mykey.pem 1024
  

  Copy to Clipboard Toggle word wrap

Procedure B.2. Create a Self-Signed Certificate

1. The nodes option causes the key to be stored without encryption. OpenSSL will prompt for values needed to create the certificate.

   # openssl req -x509 -nodes -days 7 -newkey rsa:1024 -keyout mykey.pem -out mycert.pem
   

   Copy to Clipboard Toggle word wrap
2. The subj option can be used to specify values and avoid interactive prompts, for example:

   # openssl req -x509 -nodes -days 7 -subj '/C=US/ST=NC/L=Raleigh/CN=www.redhat.com' -newkey rsa:1024 -keyout mykey.pem -out mycert.pem
   

   Copy to Clipboard Toggle word wrap
3. The new and key options generate a certificate using an existing key instead of generating a new one.

   # openssl req -x509 -nodes -days 7 -new -key mykey.pem -out mycert.pem
   

   Copy to Clipboard Toggle word wrap

1. Create a self-signed certificate for the CA, as described in Procedure B.2, “Create a Self-Signed Certificate”.
2. OpenSSL needs the following files set up for the CA to sign certificates. On a Red Hat Enterprise Linux system with a fresh OpenSSL installation using a default configuration, set up the following files:
   1. Set the path for the CA certificate file as /etc/pki/CA/cacert.pem.
   2. Set the path for the CA private key file as /etc/pki/CA/private/cakey.pem.
   3. Create a zero-length index file at /etc/pki/CA/index.txt.
   4. Create a file containing an initial serial number (for example, 01) at /etc/pki/CA/serial.
   5. The following steps must be performed on RHEL 5:
      1. Create the directory where new certificates will be stored: /etc/pki/CA/newcerts.
      2. Change to the certificate directory: cd /etc/pki/tls/certs.
3. The following command signs a CSR using the CA:

   # openssl ca -notext -out mynewcert.pem -infiles myreq.pem
   

   Copy to Clipboard Toggle word wrap

1. For OpenSSL to recognize a certificate, a hash-based symbolic link must be generated in the certs directory. /etc/pki/tls is the parent of the certs directory in Red Hat Enterprise Linux's version of OpenSSL. Use the version command to check the parent directory:

   # openssl version -d
   OPENSSLDIR: "/etc/pki/tls"
   

   Copy to Clipboard Toggle word wrap
2. Create the required symbolic link for a certificate using the following command:

   # ln -s certfile `openssl x509 -noout -hash -in certfile`.0
   

   Copy to Clipboard Toggle word wrap
   It is possible for more than one certificate to have the same hash value. If this is the case, change the suffix on the link name to a higher number. For example:

   # ln -s certfile `openssl x509 -noout -hash -in certfile`.4
   

   Copy to Clipboard Toggle word wrap