org-roam/20231108113539-self_signed_certificates.org

self_signed_certificates

• Self signed certificates
  • generate certificate_authority (a Cert without branding)
  • generate the Certificate
    • PEM to DER
    • DER to PEM
    • PFX to PEM
  • Validate a Certificate
• Install a CA Cert as a trusted root CA
  • On Arco-Linux
  • On Windows
  • On Android

X.509 is an ITU standard defining the format of public key certificates. X.509 are used in TLS/SSL, which is the basis for HTTPS. An X.509 certificate binds an identity to a public key using a digital signature. A certificate contains an identity (hostname, organization, etc.) and a public key (RSA, DSA, ECDSA, ed25519, etc.), and is either signed by a Certificate Authority or is Self-Signed.

Self signed certificates

Here is how you can generate a self signed certificate

generate certificate_authority (a Cert without branding)

First you need to generate a RSA

  openssl genrsa -aes256 -out ca-key.pem 4096

Then a public CA cert has to be gereated

  openssl req -new -x509 -sha256 -days 365 -key ca-key.pem -out ca.pem

The content of those can be viewed with the commands

  openssl x509 -in ca.pem -text
  openssl x509 -in ca.pem -purpose -noout -text

generate the Certificate

To generate an actual certificate for your website you also need to generate an RSA Key

  openssl genrsa -out cert-key.pem 4096

but this time you create a certificate signing request (CSR)

 openssl req -new -sha256 -subj "/CN=yourcn" -key cert-key.pem -out cert.csr

You then need to create an extfile with all the elternating names of your domain

  echo "subjectAltName=DNS:your-dns.record,IP:257.10.10.1" >> extfile.cnf

With that you can then create the actual branded certificate

  openssl x509 -req -sha256 -days 365 -in cert.csr -CA ca.pem -CAkey ca-key.pem -out cert.pem -extfile extfile.cnf -CAcreateserial

There are different certificate Formats that can be used and those can be converted into each other. X.509 Certificates exist in Base64 Formats PEM (.pem, .crt, .ca-bundle), PKCS#7 (.p7b, p7s) and Binary Formats DER (.der, .cer), PKCS#12 (.pfx, p12).

PEM to DER

  openssl x509 -outform der -in cert.pem -out cert.der

DER to PEM

  openssl x509 -inform der -in cert.der -out cert.pem

PFX to PEM

  openssl pkcs12 -in cert.pfx -out cert.pem -nodes

Validate a Certificate

To verify a Certificate try the following code:

  openssl verify -CAfile ca.pem -verbose cert.pem

Install a CA Cert as a trusted root CA

For a computer to trust a self signed certificate or a CA the certificate needs to be installed as a trusted root cert on the computer itself. In this way a Self signed cert can be used to secure a self hosted service without using public trusted CA (In an corporal environment or a private subnetwork and offline).

First move the generated CA certificate (here ca.pem) into /usr/local/share/ca-certificates/ca.crt. Then you need to update the cert store:

  sudo update-ca-certificates

On Arco-Linux

Here you need to implement it system wide with the following commands:

  sudo trust anchor --store myCA.crt

The certificate will be written to /etc/ca-certificates/trust-source/myCA.p11-kit and the "legacy" directories automatically updated. If you get "no configured writable location" or a similar error, import the CA manually: Copy the certificate to the /etc/ca-certificates/trust-source/anchors directory. and then:

 sudo update-ca-trust

On Windows

Assuming the path to your generated CA certificate as C:\ca.pem, run:

  Import-Certificate -FilePath "C:\ca.pem" -CertStoreLocation Cert:\LocalMachine\Root

Set -CertStoreLocation to Cert:\CurrentUser\Root in case you want to trust certificates only for the logged in user. Or in the command prompt run:

  certutil.exe -addstore root C:\ca.pem

On Android

The exact steps vary device-to-device, but here is a generalised guide:

• Open Phone Settings
• Locate Encryption and Credentials section. It is generally found under Settings > Security > Encryption and Credentials
• Choose Install a certificate
• Choose CA Certificate
• Locate the certificate file ca.pem on your SD Card/Internal Storage using the file manager.
• Select to load it.
• Done!