Technical Blogs: openssl - generate self signed certificate for server & client and client authentication

openssl - generate self signed certificate for server & client and client authentication

$ openssl req -new -x509 -out ./cacert.pem -days 1200
Generating a 2048 bit RSA private key
...........................................................................................+++
....+++
writing new private key to 'privkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:Karnataka
Locality Name (eg, city) [Default City]:Bangalore
Organization Name (eg, company) [Default Company Ltd]:freelance
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:blogspot.in
Email Address []:test@blogspot

$ ls -l
-rw-rw-r-- 1 arun arun 1415 Aug 4 13:00 cacert.pem
-rw-rw-r-- 1 arun arun 1834 Aug 4 13:00 privkey.pem

$ openssl req -new -out srvcert.csr
Generating a 2048 bit RSA private key
....................+++
.......+++
writing new private key to 'privkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:TamilNadu
Locality Name (eg, city) [Default City]:Chennai
Organization Name (eg, company) [Default Company Ltd]:consultant
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:freelance
Email Address []:test@freelance

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:test
An optional company name []:

$ openssl req -new -out clientcert.csr
Generating a 2048 bit RSA private key
.................+++
..................................................................................................................................................................+++
writing new private key to 'privkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:Kerala
Locality Name (eg, city) [Default City]:Cochin
Organization Name (eg, company) [Default Company Ltd]:freelance
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:bluetech
Email Address []:test@bluetech

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:test
An optional company name []:
[arun@ clientcert]$
[arun@ clientcert]$ ls -l
total 8
-rw-rw-r-- 1 arun arun 1070 Aug 4 13:16 clientcert.csr
-rw-rw-r-- 1 arun arun 1834 Aug 4 13:16 privkey.pem

[arun@ srvcert]$ openssl x509 -req -CA ../cacert/cacert.pem -CAcreateserial -CAserial ../cacert/caserial.txt -CAkey ../cacert/privkey.pem -days 1200 -in ./srvcert.csr -out ./srvcert.signed.cert

Signature ok

subject=/C=IN/ST=TamilNadu/L=Chennai/O=consultant/OU=IT/CN=freelance/emailAddress=test@freelance

Getting CA Private Key

Enter pass phrase for ../cacert/privkey.pem:

[arun@ clientcert]$ openssl x509 -req -CA ../cacert/cacert.pem -CAcreateserial -CAserial ../cacert/caserial.txt -CAkey ../cacert/privkey.pem -days 1200 -in ./clientcert.csr -out ./clientcert.signed.cert

Signature ok

subject=/C=IN/ST=Kerala/L=Cochin/O=freelance/OU=IT/CN=bluetech/emailAddress=test@bluetech

Getting CA Private Key

Enter pass phrase for ../cacert/privkey.pem:

[arun@ srvcert]$ openssl s_server -CAfile ../cacert/cacert.pem -cert ./srvcert.signed.cert -key ./privkey.pem -WWW -Verify ../clientcert/clientcert.signed.cert -verify_return_error

verify depth is 0, must return a certificate

Enter pass phrase for ./privkey.pem:

Using default temp DH parameters

Using default temp ECDH parameters

depth=0 C = IN, ST = Andra, L = Hyderabad, O = somesoft, OU = IT, CN = somesoft, emailAddress = user@somesoft

verify error:num=18:self signed certificate

verify return:0

140506713479032:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:3360:

depth=1 C = IN, ST = Karnataka, L = Bangalore, O = freelance, OU = IT, CN = blogspot.in, emailAddress = test@blogspot

verify return:1

depth=0 C = US, ST = California, L = SanJose, O = somecomp, OU = IT, CN = testuser, emailAddress = testuser@somecomp

verify return:1

depth=1 C = IN, ST = Karnataka, L = Bangalore, O = freelance, OU = IT, CN = blogspot.in, emailAddress = test@blogspot

verify return:1

depth=0 C = IN, ST = Kerala, L = Cochin, O = freelance, OU = IT, CN = bluetech, emailAddress = test@bluetech

verify return:1

depth=1 C = IN, ST = Karnataka, L = Bangalore, O = freelance, OU = IT, CN = blogspot.in, emailAddress = test@blogspot

verify return:1

depth=0 C = IN, ST = Kerala, L = Cochin, O = freelance, OU = IT, CN = bluetech, emailAddress = test@bluetech

verify return:1

depth=1 C = IN, ST = Karnataka, L = Bangalore, O = freelance, OU = IT, CN = blogspot.in, emailAddress = test@blogspot

verify return:1

depth=0 C = IN, ST = Kerala, L = Cochin, O = freelance, OU = IT, CN = bluetech, emailAddress = test@bluetech

verify return:1

depth=0 C = IN, ST = Andra, L = Hyderabad, O = somesoft, OU = IT, CN = somesoft, emailAddress = user@somesoft

verify error:num=18:self signed certificate

verify return:0

140506713479032:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:3360:

[arun@ clientcert]$ openssl s_client -cert ./clientcert.signed.cert -key ./privkey.pem -CAfile ../cacert/cacert.pem

Enter pass phrase for ./privkey.pem:

CONNECTED(00000003)

depth=1 C = IN, ST = Karnataka, L = Bangalore, O = freelance, OU = IT, CN = blogspot.in, emailAddress = test@blogspot

verify return:1

depth=0 C = IN, ST = TamilNadu, L = Chennai, O = consultant, OU = IT, CN = freelance, emailAddress = test@freelance

verify return:1

---

Certificate chain

0 s:/C=IN/ST=TamilNadu/L=Chennai/O=consultant/OU=IT/CN=freelance/emailAddress=test@freelance

i:/C=IN/ST=Karnataka/L=Bangalore/O=freelance/OU=IT/CN=blogspot.in/emailAddress=test@blogspot

1 s:/C=IN/ST=Karnataka/L=Bangalore/O=freelance/OU=IT/CN=blogspot.in/emailAddress=test@blogspot

i:/C=IN/ST=Karnataka/L=Bangalore/O=freelance/OU=IT/CN=blogspot.in/emailAddress=test@blogspot

---

Server certificate

-----BEGIN CERTIFICATE-----

MIIDkDCCAngCCQCdtNefIFwpWTANBgkqhkiG9w0BAQUFADCBijELMAkGA1UEBhMC

SU4xEjAQBgNVBAgMCUthcm5hdGFrYTESMBAGA1UEBwwJQmFuZ2Fsb3JlMRIwEAYD

VQQKDAlmcmVlbGFuY2UxCzAJBgNVBAsMAklUMRQwEgYDVQQDDAtibG9nc3BvdC5p

bjEcMBoGCSqGSIb3DQEJARYNdGVzdEBibG9nc3BvdDAeFw0xNTA4MDQwNzUzMzda

Fw0xODExMTYwNzUzMzdaMIGIMQswCQYDVQQGEwJJTjESMBAGA1UECAwJVGFtaWxO

YWR1MRAwDgYDVQQHDAdDaGVubmFpMRMwEQYDVQQKDApjb25zdWx0YW50MQswCQYD

VQQLDAJJVDESMBAGA1UEAwwJZnJlZWxhbmNlMR0wGwYJKoZIhvcNAQkBFg50ZXN0

QGZyZWVsYW5jZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKxdkP/y

z4OsmWuNZF2V9N9r4ctmKwU0ylI2Q7Y6Icmtr3MjC+Od3HAjmJL/X/1Lix1+fgbb

OwENwauRSn2NOyX1GApNkcG/htdZIKQe/r5TjVGvGkv7thNIUe2uIHedhyswXoHI

WUMd0iC56YApaM5AJCh06BeOgTjANSfrApNUvC/AFQmsTfqTHqK5q7q6eGMFa5ZR

TTLfOtvsbsXTopnN1ncMo7txhLSopbQA2Dd2rQe0j73DvBKQjpNFa6BHzIKRBZs7

S00MpG5UWc60MLBmUMTrE3GXl3hPlYy3DgcaJpXCQyJc+xVj5lDw6testj4C5694

NPXneMHsVzEkHuECAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAfnrLMV/izdKiFwnY

0Lj+mvFBnJcv5b2kX23blLxFQ5XATmxFe1HyA9JafpJDhV6PprVdmrNUoRWRPnNN

dm6mYUaK8IzOGW7WiQ89TSbHTaN3Y83nzd4freE+GwtISEEKELsF21l7Go+vByd2

4dv9F1ye7e+HcBtRshapRnlTqmCQvUJ0G/SQVfpfI4RUL+vGDX7n+DOBNCEcNa7A

B7I/WsdjV1Km2aHZms1WTGXSKGyYU13JdaoCjCSwZfWLl17n4YPRgmQ7KZ4H7fQy

NisdAewtaDbZWNEVD48/NZfziC+qFL7uw54cLJEntjy2y1iHB6Yx/vSbApapCzCu

sOHwHg==

-----END CERTIFICATE-----

subject=/C=IN/ST=TamilNadu/L=Chennai/O=consultant/OU=IT/CN=freelance/emailAddress=test@freelance

issuer=/C=IN/ST=Karnataka/L=Bangalore/O=freelance/OU=IT/CN=blogspot.in/emailAddress=test@blogspot

---

Acceptable client certificate CA names

/C=IN/ST=Karnataka/L=Bangalore/O=freelance/OU=IT/CN=blogspot.in/emailAddress=test@blogspot

Server Temp Key: ECDH, prime256v1, 256 bits

---

SSL handshake has read 3680 bytes and written 2532 bytes

---

New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256

Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

Protocol : TLSv1.2

Cipher : ECDHE-RSA-AES128-GCM-SHA256

Session-ID: 161D5C7007A42B926E3F0157FF6AD02E94CAE021741E826FD707520DE93A78B9

Session-ID-ctx:

Master-Key: EA74189909BA6DCF8DBB5D0492D7CCADD5AC62AA22E1C15E9036F31A2027ECB3D3C2C27A6708DC6AF413C68AD99C2186

Key-Arg : None

Krb5 Principal: None

PSK identity: None

PSK identity hint: None

TLS session ticket lifetime hint: 300 (seconds)

TLS session ticket:

0000 - 4a d3 be ac 6e 74 c5 6f-b6 75 7c 2b af 0d 1b 0b J...nt.o.u|+....

0010 - 01 9a d6 a3 2f 8a 9f 9b-40 8e f1 d6 25 51 ae bd ..../...@...%Q..

0020 - 68 1a 0b 12 cf f9 bb c2-aa 76 6e 40 61 c0 2f 6f h........vn@a./o

0030 - 5c 87 4a 9c 1e 3e de a1-50 eb 38 3c 48 99 7c 84 \.J..>..P.8<H.|.

0040 - c1 60 1c 3a fb 50 61 a6-9d e4 3c 41 ea d0 8a c6 .`.:.Pa...<A....

0050 - 4d da 59 14 72 f9 1f 7a-87 d7 7c 13 2f 22 b6 fc M.Y.r..z..|./"..

0060 - 46 8c 06 0f 1e fe 74 ec-c4 da 47 82 ae 0d e7 42 F.....t...G....B

0070 - 3c 2e a9 34 0d 42 5d cd-d5 5a 31 c2 89 bf 19 26 <..4.B]..Z1....&

0080 - 50 6d 8d 3c 9c 04 82 ca-d1 63 17 0f 11 4f 5e 94 Pm.<.....c...O^.

0090 - b6 fc b5 ea ec 71 0d 7c-74 61 a9 df 83 3e cd 92 .....q.|ta...>..

00a0 - df f3 b8 8d 30 34 a4 fb-a7 da 19 43 0b 26 4e dc ....04.....C.&N.

00b0 - 51 2f 4a d4 6f fc 58 d0-5c e1 0b cc 99 05 9d b0 Q/J.o.X.\.......

00c0 - ff c2 a0 4c 8e 9f 2c 92-de 34 a9 ab ec 18 27 85 ...L..,..4....'.

00d0 - db 2f 57 7d 6f 03 c9 d0-c0 da ff 27 97 29 87 ae ./W}o......'.)..

00e0 - 6a df d2 4a 65 98 34 6f-f5 18 05 df 95 74 0e 33 j..Je.4o.....t.3

00f0 - 4b f0 1b 27 11 1e 9d 64-12 14 9d 00 aa 5e 2e e4 K..'...d.....^..

0100 - 02 69 2d b0 0a 62 eb 84-0c 91 28 a1 47 cf d4 8e .i-..b....(.G...

0110 - 26 9f c1 d9 70 6b ca b9-d9 57 40 1d a2 77 12 50 &...pk...W@..w.P

0120 - 04 5a 5e 2c 90 17 02 e5-46 b7 c8 13 8a 42 ac 58 .Z^,....F....B.X

0130 - aa 31 0a 65 a0 a4 9e 63-48 61 f2 b3 7a 61 34 b3 .1.e...cHa..za4.

0140 - 30 b3 57 1b eb c6 b5 59-db 21 dd 95 11 e2 2f a2 0.W....Y.!..../.

0150 - 5b dc 87 61 22 63 85 b2-0b f0 e0 16 61 cc 81 c1 [..a"c......a...

0160 - 65 a9 bc fe 84 ff 5e 8a-32 0b a5 c0 92 b5 02 9a e.....^.2.......

0170 - 5a 7c c2 76 45 f7 a5 0a-0c 4b 41 ae 9b 70 d8 69 Z|.vE....KA..p.i

0180 - ff fa 80 17 f2 ae bc 65-f8 86 2a 77 b1 31 71 58 .......e..*w.1qX

0190 - 37 d1 68 82 96 f8 0e c1-0d 3b e6 48 b3 e3 41 ea 7.h......;.H..A.

01a0 - 05 d1 f1 d7 99 b3 db c4-09 25 d1 2d a0 c2 20 66 .........%.-.. f

01b0 - fd f9 13 61 8b 39 1c 68-e2 7b 61 54 cf 72 ff 97 ...a.9.h.{aT.r..

01c0 - a0 09 59 67 e7 f5 e6 b2-59 5e 89 60 4c 9e de 42 ..Yg....Y^.`L..B

01d0 - 7e af 58 de 66 00 eb b8-ab 94 83 f2 65 95 c1 1d ~.X.f.......e...

01e0 - 45 07 2f 8f 5f 8a e5 47-42 44 d6 8d ea 89 87 b5 E./._..GBD......

01f0 - f7 42 04 35 3d 25 2e 8c-19 2b 27 5f 99 1f 1d 9b .B.5=%...+'_....

0200 - a2 c3 fa 92 81 be 6d 32-d5 b8 1a 8e 49 b3 b2 58 ......m2....I..X

0210 - 0e ff 08 36 4b 71 f2 49-6d 3e 20 63 ba 2e 77 2c ...6Kq.Im> c..w,

0220 - 05 be 5d 57 ae 87 21 cb-e9 2f 62 ee 82 a3 02 1f ..]W..!../b.....

0230 - 6d f2 f9 8b 2c ef 0e 43-79 f0 51 9d 4e 41 75 82 m...,..Cy.Q.NAu.

0240 - 1a 9c 4a e9 b3 d2 e0 87-cc df 17 c1 3f 14 4d 06 ..J.........?.M.

0250 - ca f1 f2 2e 25 f8 27 02-0c c8 cd 4c 9f dc 1f 4c ....%.'....L...L

0260 - 27 02 dd 37 a7 d6 c1 16-f5 27 a7 5c 7e a1 b0 e1 '..7.....'.\~...

0270 - 33 82 ab cd fe 3b 3f 9a-13 ea 24 b7 95 9c 63 e7 3....;?...$...c.

0280 - 31 6e 81 fc 4a 12 3b f9-45 b5 87 6c 54 6d 99 eb 1n..J.;.E..lTm..

0290 - 4a 61 3f be 22 de 74 ae-f5 95 9b 44 48 63 ee 41 Ja?.".t....DHc.A

02a0 - 22 de 5d 8d 03 0a 28 05-92 34 3b 60 da 28 ed e6 ".]...(..4;`.(..

02b0 - c6 82 49 00 a4 5f 90 94-81 4d dd fd 1f 10 2b 8e ..I.._...M....+.

02c0 - 46 7e 29 96 04 78 67 bb-c6 e9 2f b6 c5 3c 9c 7a F~)..xg.../..<.z

02d0 - d2 1b 71 2c 5c 5f 83 82-c4 d6 45 63 05 49 d9 2e ..q,\_....Ec.I..

02e0 - 5e ac f7 4f f9 6d ef ef-b9 99 93 41 6b 31 23 9b ^..O.m.....Ak1#.

02f0 - f5 85 66 e1 94 2d fd 14-b8 5d 0e 7a 6d 6f 33 d6 ..f..-...].zmo3.

0300 - 1f 2d d8 10 03 df 4e fd-55 cb e5 26 15 32 d5 30 .-....N.U..&.2.0

0310 - 84 6e 0c e8 8c d4 66 d1-4d 0c 22 ad 6e f3 a2 d5 .n....f.M.".n...

0320 - 6d 7b d5 cc bd 5d 39 96-aa 70 e0 34 8d bf 4e 5c m{...]9..p.4..N\

0330 - a6 0b 4d df af 1c 33 ea-3a 74 af 7c 91 43 1d 1e ..M...3.:t.|.C..

0340 - 27 de cd 29 6f 66 a5 b5-b7 18 02 a2 64 8b 75 8a '..)of......d.u.

0350 - 15 fb 85 43 b4 27 f3 01-e0 68 da a4 74 39 b6 07 ...C.'...h..t9..

0360 - d4 12 77 31 39 da 45 16-95 e4 90 d3 2e e3 30 93 ..w19.E.......0.

0370 - 97 e5 9b 11 06 20 b2 a8-41 2b 40 43 47 dc e8 7d ..... ..A+@CG..}

0380 - 27 38 0d 86 bf 1c da 07-76 ed 39 aa 38 1e 87 98 '8......v.9.8...

0390 - 3b 23 01 41 3b 8e 8c d7-2f f7 71 a5 6c db 80 59 ;#.A;.../.q.l..Y

03a0 - b4 54 f4 f8 6b 98 76 08-42 ad 2d 6a 38 bb 7d 47 .T..k.v.B.-j8.}G

03b0 - 7c 43 f0 e4 a1 80 07 18-5d 54 26 c4 11 f5 31 ff |C......]T&...1.

03c0 - 15 cf c0 86 e5 af 9c 42-9b d6 b2 93 8e 0b bc a6 .......B........

03d0 - d2 5b 32 e9 16 7e 8e f2-77 08 a4 c2 68 aa c7 69 .[2..~..w...h..i

03e0 - 76 63 fb d9 4c 18 36 5a-e0 5f d4 48 9b 61 df 73 vc..L.6Z._.H.a.s

03f0 - cd 83 62 75 d0 c4 04 a6-4e 90 b2 be 83 7a bb e7 ..bu....N....z..

0400 - 59 55 d3 1f 64 fd 27 76-d8 3d 54 11 a2 51 08 5e YU..d.'v.=T..Q.^

0410 - 60 53 6b 25 dc 00 02 7b-21 84 87 32 11 e4 d5 ef `Sk%...{!..2....

0420 - 7a 73 9c 3c 30 1d 7a c3-a7 72 5c 93 a9 7d 86 9a zs.<0.z..r\..}..

Start Time: 1438677661

Timeout : 300 (sec)

Verify return code: 0 (ok)

---

[arun@ clientcert]$