41 lines
1.0 KiB
Markdown
41 lines
1.0 KiB
Markdown
> Based on article https://www.baeldung.com/openssl-self-signed-cert
|
|
|
|
## Build a home made root CA
|
|
|
|
mkdir -p /app/CA
|
|
cd /app/CA
|
|
|
|
Create rootCA private key:
|
|
|
|
openssl genrsa -des3 -out rootCA.key 4096
|
|
|
|
Create rootCA certificate:
|
|
|
|
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 7300 -out rootCA.pem
|
|
|
|
|
|
## Generate client root CA signed certificate for a client
|
|
|
|
Client private key:
|
|
|
|
openssl genrsa -out raxus.swgalaxy.key 2048
|
|
|
|
Client certificate signature request:
|
|
|
|
openssl req -new -key raxus.swgalaxy.key -out raxus.swgalaxy.csr
|
|
|
|
Root CA create a signed certificate using the certificate signature request:
|
|
|
|
openssl x509 -req -CA rootCA.pem -CAkey rootCA.key -in raxus.swgalaxy.csr -out raxus.swgalaxy.crt -days 365 -CAcreateserial
|
|
|
|
Optionally create the full chain:
|
|
|
|
cat raxus.swgalaxy.crt rootCA.pem > raxus.swgalaxy.fullchain.crt
|
|
|
|
Optionally create an export to be imported into a Oracle wallet:
|
|
|
|
openssl pkcs12 -export \
|
|
-in raxus.swgalaxy.crt \
|
|
-inkey raxus.swgalaxy.key \
|
|
-certfile rootCA.pem \
|
|
-out raxus.swgalaxy.p12 |