# How to generate SSL keys

- Locate CA.pl or CA.sh

In Debian GNU/Linux are located in /usr/lib/ssl/misc/

- Create a new CA:

    $ /usr/lib/ssl/misc/CA.pl -newca
    CA certificate filename (or enter to create) <press enter>

    Making CA certificate ...
    Generating a 1024 bit RSA private key
    .............++++++
    .......................................++++++
    writing new private key to './demoCA/private/cakey.pem'
    Enter PEM pass phrase: <type the secret phrase again>
    Verifying - Enter PEM pass phrase: <type the secret phrase again>
    -----
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:ES
    State or Province Name (full name) [Some-State]:.
    Locality Name (eg, city) []:.
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:Cherokee Team
    Organizational Unit Name (eg, section) []:<Enter>
    Common Name (eg, YOUR name) []:Cherokee Certificate Master
    Email Address []:alvaro@alobbs.com

- Generate a certificate request

    $ /usr/lib/ssl/misc/CA.pl -newreq
    Generating a 1024 bit RSA private key
    .....................................++++++
    ...++++++
    writing new private key to 'newreq.pem'
    Enter PEM pass phrase: <anothe phrase>
    Verifying - Enter PEM pass phrase: <repeat it>
    -----
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:ES
    State or Province Name (full name) [Some-State]:.
    Locality Name (eg, city) []:.
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:Cherokee web server
    Organizational Unit Name (eg, section) []:.
    Common Name (eg, YOUR name) []:www.0x50.org
    Email Address []:sysop@0x50.org

    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []: <Enter>
    An optional company name []: <Enter>
    Request (and private key) is in newreq.pem

- Sign the certificate request

    $ /usr/lib/ssl/misc/CA.pl -sign
    Using configuration from /usr/lib/ssl/openssl.cnf
    Enter pass phrase for ./demoCA/private/cakey.pem:
    Check that the request matches the signature
    Signature ok
    Certificate Details:
            Serial Number: 1 (0x1)
            Validity
                Not Before: Aug 17 13:12:44 2003 GMT
                Not After : Aug 16 13:12:44 2004 GMT
            Subject:
                countryName               = ES
                organizationName          = Cherokee web server
                commonName                = www.0x50.org
                emailAddress              = sysop@0x50.org
            X509v3 extensions:
                X509v3 Basic Constraints:
                CA:FALSE
                Netscape Comment:
                OpenSSL Generated Certificate
                X509v3 Subject Key Identifier:
                14:6A:45:66:A2:EB:73:74:5A:C5:68:80:50:D5:48:94:DD:ED:25:F7
                X509v3 Authority Key Identifier:
                keyid:9E:E0:E2:6E:1B:02:17:F2:72:C9:0D:E3:DA:C9:E1:8F:CE:BC:6E:A2
                DirName:/C=ES/ST=Madrid/L=Madrid/O=Cherokee Team/CN=Cherokee Certificate Master/emailAddress=alvaro@alobbs.com
                serial:00

    Certificate is to be certified until Aug 16 13:12:44 2004 GMT (365 days)
    Sign the certificate? [y/n]:y

    1 out of 1 certificate requests certified, commit? [y/n]y
    Write out database with 1 new entries
    Data Base Updated
    Signed certificate is in newcert.pem

## Self signed certificates

It's another way to generate certificate files. Ramon Pons sent this little script to create self signed certificates:

    #!/bin/sh

    CERTNAME=cherokee.pem
    openssl req -days 1000 -new -x509 -nodes -out $CERTNAME -keyout $CERTNAME
    chmod 600 $CERTNAME
    openssl verify $CERTNAME
    if [ $? != 0 ]; then
         \mv $CERTNAME $CERTNAME.not_valid
    fi