:PROPERTIES:
:ID:       eff86d3a-1ae2-4b92-8c6d-c87c16553253
:END:
#+title:  self_signed_certificates

X.509 is an ITU standard defining the format of public key [[id:e28dfeaa-876b-4255-a25e-dcc0c909d08a][certificates]]. X.509 are used in [[id:872ee33b-8361-40c7-9d88-69b3afe5ade2][TLS]]/[[id:95c8982d-e104-43a2-9bb2-fd7e1c3204f2][SSL]], which is the basis for HTTPS. An X.509 certificate binds an identity to a public key using a digital signature. A certificate contains an identity (hostname, organization, etc.) and a public key (RSA, DSA, ECDSA, ed25519, etc.), and is either signed by a Certificate Authority or is Self-Signed.

* Self signed certificates
Here is how you can generate a self signed certificate
** generate [[id:89d22755-3547-4b92-8933-c31aa3f9cb12][certificate_authority]] (a Cert without branding)

First you need to generate a [[id:23a9283c-0afe-43d6-bc31-2e7bd838b2de][RSA]] 
#+begin_src bash
  openssl genrsa -aes256 -out ca-key.pem 4096
#+end_src

Then a public CA cert has to be gereated
#+begin_src bash
  openssl req -new -x509 -sha256 -days 365 -key ca-key.pem -out ca.pem
#+end_src

The content of those can be viewed with the commands
#+begin_src bash
  openssl x509 -in ca.pem -text
  openssl x509 -in ca.pem -purpose -noout -text
#+end_src

** generate the Certificate

To generate an actual certificate for your website you also need to generate an RSA Key
#+begin_src bash
  openssl genrsa -out cert-key.pem 4096
#+end_src

but this time you create a certificate signing request ([[id:f2991e03-0c05-490e-a0d1-dda24c7e58e6][CSR]])
#+begin_src bash
 openssl req -new -sha256 -subj "/CN=yourcn" -key cert-key.pem -out cert.csr 
#+end_src

You then need to create an ~extfile~ with all the elternating names of your domain
#+begin_src bash
  echo "subjectAltName=DNS:your-dns.record,IP:257.10.10.1" >> extfile.cnf
#+end_src

With that you can then create the actual branded certificate
#+begin_src bash
  openssl x509 -req -sha256 -days 365 -in cert.csr -CA ca.pem -CAkey ca-key.pem -out cert.pem -extfile extfile.cnf -CAcreateserial
#+end_src

There are different certificate Formats that can be used and those can be converted into each other. X.509 Certificates exist in Base64 Formats PEM (.pem, .crt, .ca-bundle), PKCS#7 (.p7b, p7s) and Binary Formats DER (.der, .cer), PKCS#12 (.pfx, p12). 
*** PEM to DER
#+begin_src bash
  openssl x509 -outform der -in cert.pem -out cert.der
#+end_src
*** DER to PEM
#+begin_src bash
  openssl x509 -inform der -in cert.der -out cert.pem	
#+end_src
*** PFX to PEM
#+begin_src bash
  openssl pkcs12 -in cert.pfx -out cert.pem -nodes
#+end_src

** Validate a Certificate
To verify a Certificate try the following code:
#+begin_src bash
  openssl verify -CAfile ca.pem -verbose cert.pem
#+end_src

* Install a CA Cert as a trusted root CA
For a computer to trust a self signed certificate or a CA the certificate needs to be installed as a trusted root cert on the computer itself.  In this way a Self signed cert can be used to secure a self hosted service without using public trusted CA (In an corporal environment or a private [[id:c9461f7b-7368-4b88-b90b-2d785fda2159][subnetwork]]  and offline).

First move the generated CA certificate (here ~ca.pem~) into [[/usr/local/share/ca-certificates/ca.crt]].
Then you need to update the cert store:

#+begin_src bash
  sudo update-ca-certificates
#+end_src

** On [[id:5fada795-19a3-4ba6-97c0-0b70bd728a2f][Arco-Linux]]
Here you need to implement it system wide with the following commands:
#+begin_src bash
  sudo trust anchor --store myCA.crt
#+end_src

The certificate will be written to ~/etc/ca-certificates/trust-source/myCA.p11-kit~ and the "legacy" directories automatically updated.
If you get "no configured writable location" or a similar error, import the CA manually:
Copy the certificate to the ~/etc/ca-certificates/trust-source/anchors~ directory.
and then:
#+begin_src  bash
 sudo update-ca-trust
#+end_src

** On Windows
Assuming the path to your generated CA certificate as ~C:\ca.pem~, run:
#+begin_src bash
  Import-Certificate -FilePath "C:\ca.pem" -CertStoreLocation Cert:\LocalMachine\Root
#+end_src

Set ~-CertStoreLocation~ to ~Cert:\CurrentUser\Root~ in case you want to trust certificates only for the logged in user.  Or in the command prompt run:

#+begin_src bash
  certutil.exe -addstore root C:\ca.pem
#+end_src

** On Android
The exact steps vary device-to-device, but here is a generalised guide:
- Open Phone Settings
- Locate Encryption and Credentials section. It is generally found under ~Settings > Security > Encryption and Credentials~
- Choose ~Install a certificate~
- Choose ~CA Certificate~
- Locate the certificate file ~ca.pem~ on your SD Card/Internal Storage using the file manager.
- Select to load it.
- Done!