Skip to main content

Self signed CA and CSR basics

 In pki - public key infrastructure, CA is responsible for issuing and maintaining digital certificates. They actually sign the certificate with their private key and then it becomes digital signature. They are called trusted RootCA.

But what if you don't have trusted rootca? 

In that case you need to create your own self signed CA that involves generating private key. Once the CA has been created now using this CA you can sign other certificates in your organization. Which will be called issued by this CA. Once the CA has been created then it needs to be distributed to all clients and servers who needs to trust this, this also maintain chain of trust. The process as follows:

Install openssl:

sudo apt-get install openssl

Generate the private key:

openssl genrsa -out ca.key 2048

Create new CA certificate:

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -sha256

Protect the private key:

chmod 400 ca.key

That's it. Your CA certificate has been created. You can use this certificate to sign other certificates and use ca.key and ca.crt for your certificate signing process. 

You can generate new CA certificate for several reasons. One of the reason is say your previous CA certificate was issued using sha1 algorithm which is obsolete now. If this old CA was used to sign your other certificates then you need to replace this. 

For replacing old certificates with new one or if it is completely new request for your server, in both the cases CSR - certificate signing request you need to perform. If you want your server should get a certificate signed by self signed CA, then you need to generate a csr request for your server. That CSR request contains your server address host.example.com or for whole domain name like this *.example.com along with a public key. 

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr

After CA receive this, then it will sign that (after verifying) with CA's private key. Then give back to you as your digital certificate. 

Now final task is you need to install both i mean, CA certificate and your server certificate on the same machine/server where you want to install certificate. And CA certificate also need to install because maintaining the chain of trust. 

As this is self signed CA certificate so you need to import this or install this on the servers as well for maintaining the chain of trust. For trusted root CA you don't need to do this because it is already present on computer systems and browsers trusted CA store. 

Avi


Comments

Post a Comment

Popular posts from this blog

Install Nessus from docker

Docker installation. Give the below commands one by one. apt install docker-cli apt install docker.io After the installation is complete, if you are inside wsl then give this command to start docker, because inside wsl systemd (systemctl) does not work: service docker start WSL troubleshooting : If the above command " service docker start " does not work then use below command: dockerd (It may not work if any previous docker process is running. It will show you pid of that process. Use this command to kill that process " kill -9 pid " and run dockerd command again) If " docker ps -a " giving error like " Cannot connect to the Docker daemon at unix:///run/podman/podman.sock. Is the docker daemon running? " This is because you may installed podman-docker package. If you remove the package still you will get this error but you should remove the package. Then issue this command: env | grep -i docker DOCKER_HOST=unix:///run/podman/podman.sock   -->...
Post a Comment
Read more

Installtion of SQLMutant tool

This tool is perfectly works on ubuntu 24 system. And I found it is not working properly in kali linux 24 version.   https://github.com/blackhatethicalhacking/SQLMutant/tree/main This tool need to use along with sqlmap tool. Showing this cheat sheet for kali or debian based system.  This tool actually analyze everything and give you the vulnerable url where sql injection is possible. You just need to use then sqlmap to exploit that.   Prerequisite: apt install pipx -y (for ubuntu) pip3 install uro or pipx install uro pipx ensurepath pipx completions  (not needed)  source ~/.bashrc   or restart system If go tool is not installed then run the below two commands first ( golang-go ) or follow this link to install go (https://mahimfiroj.blogspot.com/2024/12/installing-nuclei-in-kali.html) otherwise skip this step.   dpkg -l | grep packagename (Using this command you can check package is installed or not) apt install gccgo-go -y or apt install gol...
Post a Comment
Read more

net command cheat sheet

  To see what users present in the system: net user To see local groups in the system: net localgroup To see domain groups. This should be run on a domain controller: net group To see the details of a user along with his/her group membership: net user mahim To see who are the members of a particular group (local machine): net localgroup "administrators"    (These are not case sensitive. You can use administrators or Administrators. Both will give you same result. To see who are the members of a particular group (domain machine): net group "domain admins" Create a local user: net user localuser1 MyP@ssw0rd /add Create a domain user: net user domainuser1 MyP@ssw0rd /add /domain Add the local user to local admin group: net localgroup Administrators localuser1 /add Add the user to domain admin group: net group "Domain Admins" domainuser1 /add /domain Avi
Post a Comment
Read more