2.7. Creating a private CA by using GnuTLS

Procedure

1. Generate a private key for your CA. For example, the following command creates a 256-bit ECDSA (Elliptic Curve Digital Signature Algorithm) key:

   $ certtool --generate-privkey --sec-param High --key-type=ecdsa --outfile <ca.key>

   The time for the key-generation process depends on the hardware and entropy of the host, the selected algorithm, and the length of the key.

2. Create a template file for a certificate.

   1. Create a file with a text editor of your choice, for example:

      $ vi <ca.cfg>

   2. Edit the file to include the necessary certification details:

      organization = "Example Inc."
      state = "Example"
      country = EX
      cn = "Example CA"
      serial = 007
      expiration_days = 365
      ca
      cert_signing_key
      crl_signing_key

3. Create a certificate signed using the private key generated in step 1:

   The generated <ca.crt> file is a self-signed CA certificate that you can use to sign other certificates for one year. <ca.crt> file is the public key (certificate). The loaded file <ca.key> is the private key. You should keep this file in safe location.

   $ certtool --generate-self-signed --load-privkey <ca.key> --template <ca.cfg> --outfile <ca.crt>

4. Set secure permissions on the private key of your CA, for example:

   # chown <root>:<root> <ca.key>
   # chmod 600 <ca.key>

Verification

1. Display the basic information about your self-signed CA:

   $ certtool --certificate-info --infile <ca.crt>
   Certificate:
   …
       	X509v3 extensions:
           	…
           	X509v3 Basic Constraints: critical
               	CA:TRUE
           	X509v3 Key Usage: critical
               	Certificate Sign, CRL Sign

2. Create a certificate signing request (CSR), and use your CA to sign the request. The CA must successfully create a certificate based on the CSR, for example:

   1. Generate a private key for your CA:

      $ certtool --generate-privkey --outfile <example_server.key>

   2. Open a new configuration file in a text editor of your choice, for example:

      $ vi <example_server.cfg>

   3. Edit the file to include the necessary certification details:

      signing_key
      encryption_key
      key_agreement
      
      tls_www_server
      
      country = "US"
      organization = "Example Organization"
      cn = "server.example.com"
      
      dns_name = "example.com"
      dns_name = "server.example.com"
      ip_address = "192.168.0.1"
      ip_address = "::1"
      ip_address = "127.0.0.1"

   4. Generate a request with the previously created private key:

      $ certtool --generate-request --load-privkey <example_server.key> --template <example_server.cfg> --outfile <example_server.crq>

   5. Generate the certificate and sign it with the private key of the CA:

      $ certtool --generate-certificate --load-request <example_server.crq> --load-ca-certificate <ca.crt> --load-ca-privkey <ca.key> --outfile <example_server.crt>