{"id":4765,"date":"2017-05-31T23:35:51","date_gmt":"2017-05-31T21:35:51","guid":{"rendered":"http:\/\/michlstechblog.info\/blog\/?p=4765"},"modified":"2018-12-06T08:40:23","modified_gmt":"2018-12-06T07:40:23","slug":"openssl-setup-an-intermediate-ca","status":"publish","type":"post","link":"https:\/\/michlstechblog.info\/blog\/openssl-setup-an-intermediate-ca\/","title":{"rendered":"Openssl: Setup an intermediate CA"},"content":{"rendered":"<div class=\"twoclick_social_bookmarks_post_4765 social_share_privacy clearfix 1.6.4 locale-en_US sprite-en_US\"><\/div><div class=\"twoclick-js\"><script type=\"text\/javascript\">\/* <![CDATA[ *\/\njQuery(document).ready(function($){if($('.twoclick_social_bookmarks_post_4765')){$('.twoclick_social_bookmarks_post_4765').socialSharePrivacy({\"services\":{\"flattr\":{\"uid\":\"Michl\",\"status\":\"on\",\"the_title\":\"Openssl%3A%20Setup%20an%20intermediate%20CA\",\"the_excerpt\":\"Hi%2C%0D%0A%0D%0Afirst%20ramp%20up%20your%20root%20CA%20as%20described%20in%20my%20previous%20post.%20%0D%0ASteps%20to%20create%20a%20intermediate%20CA.%20Create%20the%20intermediate%20CA%20structure%20in%20filesystem%20%0D%0A%20%28more%26hellip%3B%29\",\"txt_info\":\"2 clicks for more data protection:\\r\\n\\r\\nOnly when you click here, the button will be come active and you can send your recommendation to Flattr. When activating, data are transmitted to third parties. \",\"perma_option\":\"off\"}},\"txt_help\":\"When you activate these fields by clicking, information to Flattr may be transferred abroad, and probably may also stored there.\",\"settings_perma\":\"Enable permanently and accept data transmission. \",\"info_link\":\"http:\\\/\\\/www.heise.de\\\/ct\\\/artikel\\\/2-Klicks-fuer-mehr-Datenschutz-1333879.html\",\"uri\":\"https:\\\/\\\/michlstechblog.info\\\/blog\\\/openssl-setup-an-intermediate-ca\\\/\",\"post_id\":4765,\"post_title_referrer_track\":\"Openssl%3A+Setup+an+intermediate+CA\",\"display_infobox\":\"on\"});}});\n\/* ]]> *\/<\/script><\/div><p>Hi,<\/p>\n<p>first ramp up your root CA as described in my previous <a href=\"http:\/\/michlstechblog.info\/blog\/openssl-create-a-root-ca\/\">post<\/a>.<br \/>\nSteps to create a intermediate CA. Create the intermediate CA structure in filesystem<br \/>\n<!--more--><br \/>\n<!--https:\/\/jamielinux.com\/docs\/openssl-certificate-authority\/create-the-root-pair.html--><br \/>\n<!--http:\/\/www.absolute-cool.de\/dokus\/ssl\/openssl\/--><br \/>\n<!--https:\/\/www.phildev.net\/ssl\/opensslconf.html--><br \/>\n<!--https:\/\/jamielinux.com\/docs\/openssl-certificate-authority--><\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\ncd \r\npwd\r\n\/root\r\nmkdir -p intermediateCA\r\nmkdir -p intermediateCA\/crl intermediateCA\/certs intermediateCA\/newcerts intermediateCA\/private intermediateCA\/conf\r\n<\/pre>\n<p>Create the openssl config file \/root\/intermediateCA\/conf\/openssl.cnf<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n#\r\n# openssl.cnf root CA config \r\n#\r\n# \/root\/intermediateCA\/conf\/openssl.cnf\r\n#\r\n&#x5B; ca ]\r\ndefault_ca = myintermediateCA\r\n\r\n&#x5B; myintermediateCA]\r\n# Directory and file locations.\r\ndir               = \/root\/intermediateCA\r\ncerts             = $dir\/certs\r\ncrl_dir           = $dir\/crl\r\nnew_certs_dir     = $dir\/newcerts\r\ndatabase          = $dir\/index.txt\r\nserial            = $dir\/serial\r\nRANDFILE          = $dir\/private\/.rand\r\n\r\n# The root key and root certificate.\r\nprivate_key       = $dir\/private\/intermediateca.key\r\ncertificate       = $dir\/certs\/intermediateca.cer\r\n\r\n# For certificate revocation lists.\r\ncrlnumber         = $dir\/crlnumber\r\ncrl               = $dir\/crl\/crl.pem\r\ncrl_extensions    = crl_ext\r\ndefault_crl_days  = 90\r\n\r\n# Use at least sha256\r\ndefault_md        = sha256\r\n\r\nname_opt          = ca_default\r\ncert_opt          = ca_default\r\ndefault_days      = 3650\r\npreserve          = no\r\npolicy            = policy_strict\r\n\r\n&#x5B; policy_strict ]\r\n# The root CA should only sign intermediate certificates that match.\r\ncountryName             = match\r\nstateOrProvinceName     = match\r\norganizationName        = match\r\norganizationalUnitName  = optional\r\ncommonName              = supplied\r\nemailAddress            = optional\r\n\r\n&#x5B; policy_loose ]\r\n# Allow the intermediate CA to sign a more diverse range of certificates.\r\ncountryName             = optional\r\nstateOrProvinceName     = optional\r\nlocalityName            = optional\r\norganizationName        = optional\r\norganizationalUnitName  = optional\r\ncommonName              = supplied\r\nemailAddress            = optional\r\n\r\n&#x5B; req ]\r\ndefault_bits        = 2048\r\ndistinguished_name  = req_distinguished_name\r\nstring_mask         = utf8only\r\n\r\n# Use at least sha256\r\ndefault_md          = sha256\r\n\r\n# Extension for -x509 option\r\nx509_extensions     = v3_root_ca\r\n\r\n&#x5B; req_distinguished_name ]\r\ncountryName                     = Country Name (2 letter code)\r\nstateOrProvinceName             = State or Province Name\r\nlocalityName                    = Locality Name\r\n0.organizationName              = Organization Name\r\norganizationalUnitName          = Organizational Unit Name\r\ncommonName                      = Common Name\r\nemailAddress                    = Email Address\r\n\r\n# Defaults\r\ncountryName_default             = DE\r\nstateOrProvinceName_default     = Germany\r\nlocalityName_default            = Nuremberg\r\n0.organizationName_default      = my Company\r\norganizationalUnitName_default  = my Department\r\nemailAddress_default            = me@mycompany.org\r\n\r\n&#x5B; v3_root_ca ]\r\n# Extensions for the CA\r\nsubjectKeyIdentifier = hash\r\nauthorityKeyIdentifier = keyid:always,issuer\r\nbasicConstraints = critical, CA:true\r\n#keyUsage = critical, digitalSignature, cRLSign, keyCertSign\r\nkeyUsage = critical, cRLSign, keyCertSign\r\ncrlDistributionPoints=URI:http:\/\/yourDomain.org\/crl\/intermediateca-ca-crl.pem\r\n\r\n&#x5B; v3_intermediate_ca ]\r\n# Extensions for the intermediate CA\r\nsubjectKeyIdentifier = hash\r\nauthorityKeyIdentifier = keyid:always,issuer\r\nbasicConstraints = critical, CA:true, pathlen:0\r\n#keyUsage = critical, digitalSignature, cRLSign, keyCertSign\r\nkeyUsage = critical, cRLSign, keyCertSign\r\n\r\n&#x5B; client_cert ]\r\n# Extensions for client certificates\r\nbasicConstraints = CA:FALSE\r\nnsCertType = client, email\r\nnsComment = &quot;OpenSSL Generated Client Certificate&quot;\r\nsubjectKeyIdentifier = hash\r\nauthorityKeyIdentifier = keyid,issuer\r\nkeyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment\r\nextendedKeyUsage = clientAuth, emailProtection\r\n\r\n&#x5B; server_cert ]\r\n# Extensions for server certificates\r\nbasicConstraints = CA:FALSE\r\nnsCertType = server\r\nnsComment = &quot;OpenSSL Generated Server Certificate&quot;\r\nsubjectKeyIdentifier = hash\r\nauthorityKeyIdentifier = keyid,issuer:always\r\nkeyUsage = critical, digitalSignature, keyEncipherment\r\nextendedKeyUsage = serverAuth,clientAuth\r\n\r\n&#x5B; crl_ext ]\r\n# Extension for CRL\r\nauthorityKeyIdentifier=keyid:always\r\n\r\n&#x5B; ocsp ]\r\n# Extension for OCSP signing certificates\r\nbasicConstraints = CA:FALSE\r\nsubjectKeyIdentifier = hash\r\nauthorityKeyIdentifier = keyid,issuer\r\nkeyUsage = critical, digitalSignature\r\nextendedKeyUsage = critical, OCSPSigning\r\n<\/pre>\n<p>create index und serial file<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\ncd intermediateCA\r\ntouch index.txt\r\necho 1000 &gt; serial\r\necho 1000 &gt; crlnumber\r\n<\/pre>\n<p>If specified, openssl using the config defined at environment variable OPENSSL_CONF. Otherwise you have to set command line option -config for each command line call. When you omit the pass* parameter openssl will prompt for the password.<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nexport OPENSSL_CONF=\/root\/intermediateCA\/conf\/openssl.cnf\r\nopenssl genrsa -aes256 -out private\/intermediateca.key -passout pass:YourSecurePassword 4096\r\nchmod 400 private\/intermediateca.key\r\n<\/pre>\n<p>Show key details<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nopenssl rsa -in private\/intermediateca.key -text\r\n<\/pre>\n<p>Create a siging request for your intermediate CA.<br \/>\n<strong>Note:<\/strong> countryName (C), stateOrProvinceName (ST) ,organizationName (O) must match to the corresponding root CA properties(see openssl.cnf section policy_strict). The common name (CN) must differ<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\"> \r\nopenssl req -key private\/intermediateca.key -new -sha256 -out certs\/intermediateca.csr -subj &quot;\/C=DE\/ST=Frankonia\/L=Nuremberg\/O=my Company\/OU=my Department\/CN=My intermediateca CA 2017&quot; -passin pass:YourSecurePassword\r\n<\/pre>\n<p>View details of your new intermediate CA certificate<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nopenssl req -in certs\/intermediateca.csr -text -noout\r\n<\/pre>\n<p><!--Create the crl\n#[shell]\n#openssl ca -gencrl -out crl\/crl.pem -passin pass:YourSecurePassword\n#[\/shell]\n--><br \/>\nSwitch to the root CA environment and sign the intermediate CA csr with your root CA certifiate with the x509v3 intermediate extensions.<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nexport OPENSSL_CONF=\/root\/CA\/conf\/openssl.cnf\r\nopenssl ca -extensions v3_intermediate_ca -days 3650 -notext -md sha256 -in certs\/intermediateca.csr -out certs\/intermediate.cer -passin pass:YourSecurePassword\r\n<\/pre>\n<p>Show the details of your intermediate CA certificate<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nopenssl x509 -in certs\/intermediate.cer -text -noout\r\n<\/pre>\n<p>Verify the chain<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nopenssl verify -CAfile \/root\/CA\/certs\/ca.cer certs\/intermediate.cer\r\ncerts\/intermediate.cer: OK\r\n<\/pre>\n<p>Create a file with the complete chain<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\ncat \/root\/CA\/certs\/ca.cer certs\/intermediate.cer &gt;certs\/fullchain.cer\r\n<\/pre>\n<p>Revoke the intermediate CA ceritifcate<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nexport OPENSSL_CONF=\/root\/CA\/conf\/openssl.cnf\r\nopenssl ca -revoke \/root\/intermediateCA\/certs\/intermediate.cer -passin pass:YourSecurePassword\r\nopenssl ca -gencrl -out \/root\/CA\/crl\/crl.pem -passin pass:YourSecurePassword\r\n<\/pre>\n<p>If the company- , the state or province- or the Organization name differs from the root CA then you have to adjust the policy from <strong>policy_strict<\/strong> to <strong>policy_loose<\/strong> in the <strong>openssl.cnf<\/strong> file of your <strong>root CA<\/strong>:<br \/>\n<code>policy            = policy_loose<\/code><\/p>\n<p>otherwise you get an error: <strong>The organizationName field is different between<\/strong><\/p>\n<p>Michael<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi, first ramp up your root CA as described in my previous post. Steps to create a intermediate CA. Create the intermediate CA structure in filesystem<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1036,466],"tags":[634,143,1040,1041,547,1039],"class_list":["post-4765","post","type-post","status-publish","format-standard","hentry","category-openssl","category-security","tag-ca","tag-create","tag-intermediate","tag-issuing","tag-openssl","tag-setup"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/4765","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/comments?post=4765"}],"version-history":[{"count":32,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/4765\/revisions"}],"predecessor-version":[{"id":6115,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/4765\/revisions\/6115"}],"wp:attachment":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/media?parent=4765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/categories?post=4765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/tags?post=4765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}