RSA
openssl req -x509 -days 365 -newkey rsa:2048 -nodes -keyout self.key -out self.crt #-sha256
ECDSA with a 256-bit curve
openssl ecparam -name prime256v1 openssl req -x509 -days 365 -newkey ec:<(openssl ecparam -name prime256v1) -nodes -keyout prime256v1.key -out prime256v1.crt
ECDSA with a 384-bit curve
openssl ecparam -name secp384r1 openssl req -x509 -days 3650 -newkey ec:<(openssl ecparam -name secp384r1) -nodes -keyout secp384r1.key -out secp384r1.crt
answer at least country, email, and most importantly CN. You may enter an empty space for the rest.
as an alternative and instead of tweaking openssl.cnf
you may also use a shortcut
#openssl req -x509 -newkey rsa:2048 -out selfsign.crt -keyout selfsign.key -nodes -sha256 -days 365 #-subj /CN=$domain #-subj "/C=RU/L=Innopolis/O=Innopolis University/OU=SNE/CN=$domain/emailAddress=root@$domain"
review the newly created certificate
ls -lF *.crt *.key openssl x509 -in self.crt -text -noout -fingerprint openssl x509 -in self.crt -text -noout | less
Notes
-out
and stdin instead of -in
-nodes
to avoid encrypting the private key hence no passphrasein case you need a container
openssl pkcs12 -export -inkey self.key -in self.crt -out self.p12 openssl pkcs12 -export -inkey prime256v1.key -in prime256v1.crt -out prime256v1.p12 openssl pkcs12 -export -inkey secp384r1.key -in secp384r1.crt -out secp384r1.p12
You already have a pair on Ubuntu
ls -lF /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/ssl/private/ssl-cert-snakeoil.key
but in case you need to re-generate those
make-ssl-cert generate-default-snakeoil --force-overwrite #openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \ # -keyout /etc/ssl/private/ssl-cert-snakeoil.key \ # -out /etc/ssl/certs/ssl-cert-snakeoil.pem
On NetBSD you need to fix the config first
cp -i /usr/share/examples/openssl/openssl.cnf /etc/openssl/ cp -i /usr/share/examples/openssl/openssl.cnf /etc/openssl/openssl.cnf.dist vi /etc/openssl/openssl.cnf #default_md = sha2
Once you sent your CSR to your SSL provider, it will respond you with the PEM certificate, possibly as .crt
. You will also need their root CA and intermediate certificates – if those aren’t delivered, you might find it on their website. Eventually concatenate those two
cd /etc/httpd/ssl/ cat intermediatecert rootcert > issuer-concat-cert.crt chmod 400 issuer-concat-cert.crt
See https://lab.nethence.com/ca-bundles/
https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html https://github.com/nmap/nmap/blob/master/scripts/ssl-enum-ciphers.nse
nmap -sV --script ssl-enum-ciphers -p 443 nethence.com nmap -sV --script ssl-enum-ciphers -p 25 xc.os3.su # finds starttls on its own
https://testssl.sh/ https://github.com/drwetter/testssl.sh
./testssl.sh -h ./testssl.sh nethence.com:443 ./testssl.sh --starttls smtp xc.os3.su:25
https://github.com/nabla-c0d3/sslyze https://github.com/iSECPartners/sslyze https://nabla-c0d3.github.io/sslyze/documentation/testing-connectivity.html#additional-settings-starttls-sni-etc
Testing SSL/TLS certificates (SSLyze) https://vk9-sec.com/testing-ssl-tls-certificates-sslyze/
pip install --upgrade setuptools pip install --upgrade sslyze sslyze -h sslyze --regular --sni=nethence.com nethence.com:443 sslyze --starttls=smtp xc.os3.su:25
How To Create an SSL Certificate on Nginx for Ubuntu 14.04 https://www.digitalocean.com/community/tutorials/how-to-create-an-ssl-certificate-on-nginx-for-ubuntu-14-04
OpenSSL tips and tricks https://commandlinefanatic.com/cgi-bin/showarticle.cgi?article=art030
What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats? https://serverfault.com/questions/9708/what-is-a-pem-file-and-how-does-it-differ-from-other-openssl-generated-key-file
Command Line Utilities https://wiki.openssl.org/index.php/Command_Line_Utilities
A note about SSL/TLS trusted certificate stores, and platforms (OpenSSL and GnuTLS) https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
mk-ca-bundle the man page https://curl.haxx.se/docs/mk-ca-bundle.html
How do I re-issue OpenSSL snakeoil cert? https://askubuntu.com/questions/446228/how-do-i-re-issue-openssl-snakeoil-cert
How To Create a Self-Signed SSL Certificate for Nginx in Ubuntu 18.04 https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-18-04
Creating a Self-Signed SSL Certificate on Ubuntu https://ubuverse.com/creating-a-self-signed-ssl-certificate-on-ubuntu/
Self-Signed_Certificate https://wiki.debian.org/Self-Signed_Certificate
How can I use OpenSSL with an external source of randomness? https://security.stackexchange.com/questions/143051/how-can-i-use-openssl-with-an-external-source-of-randomness
Good entropy source for generating openssl keys https://crypto.stackexchange.com/questions/12571/good-entropy-source-for-generating-openssl-keys
Random Numbers https://wiki.openssl.org/index.php/Random_Numbers
How to speed up OpenSSL/GnuPG Entropy For Random Number Generation On Linux https://www.cyberciti.biz/open-source/debian-ubuntu-centos-linux-setup-additional-entropy-for-server-using-aveged-rng-tools-utils/
Using engines for random number generation https://stackoverflow.com/questions/29150585/using-engines-for-random-number-generation
Is it possible to generate RSA key without pass phrase? https://serverfault.com/questions/366372/is-it-possible-to-generate-rsa-key-without-pass-phrase
Why openssl insist on requiring a passphrase on genrsa command? https://superuser.com/questions/407908/why-openssl-insist-on-requiring-a-passphrase-on-genrsa-command
Creating a .pem File for SSL Certificate Installations https://www.digicert.com/ssl-support/pem-ssl-creation.htm
Does .pem file contains both private and public keys? https://stackoverflow.com/questions/7539625/does-pem-file-contains-both-private-and-public-keys
req: Unrecognized flag sha2
How to make OpenSSL with SHA256 instead of sha1? https://stackoverflow.com/questions/42857286/how-to-make-openssl-with-sha256-instead-of-sha1
Generating an SHA256 SSL CSR on CentOS/RHEL using genkey https://serverfault.com/questions/630692/generating-an-sha256-ssl-csr-on-centos-rhel-using-genkey
https://en.wikipedia.org/wiki/PKCS_12
https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm
https://gist.github.com/tsaarni/14f31312315b46f06e0f1ecc37146bf3
https://msol.io/blog/tech/create-a-self-signed-ecc-certificate/