Self signed CA and CSR basics

 In pki - public key infrastructure, CA is responsible for issuing and maintaining digital certificates. They actually sign the certificate with their private key and then it becomes digital signature. They are called trusted RootCA.

But what if you don't have trusted rootca? 

In that case you need to create your own self signed CA that involves generating private key. Once the CA has been created now using this CA you can sign other certificates in your organization. Which will be called issued by this CA. Once the CA has been created then it needs to be distributed to all clients and servers who needs to trust this, this also maintain chain of trust. The process as follows:

Install openssl:

sudo apt-get install openssl

Generate the private key:

openssl genrsa -out ca.key 2048

Create new CA certificate:

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -sha256

Protect the private key:

chmod 400 ca.key

That's it. Your CA certificate has been created. You can use this certificate to sign other certificates and use ca.key and ca.crt for your certificate signing process. 

You can generate new CA certificate for several reasons. One of the reason is say your previous CA certificate was issued using sha1 algorithm which is obsolete now. If this old CA was used to sign your other certificates then you need to replace this. 

For replacing old certificates with new one or if it is completely new request for your server, in both the cases CSR - certificate signing request you need to perform. If you want your server should get a certificate signed by self signed CA, then you need to generate a csr request for your server. That CSR request contains your server address host.example.com or for whole domain name like this *.example.com along with a public key. 

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr

After CA receive this, then it will sign that (after verifying) with CA's private key. Then give back to you as your digital certificate. 

Now final task is you need to install both i mean, CA certificate and your server certificate on the same machine/server where you want to install certificate. And CA certificate also need to install because maintaining the chain of trust. 

As this is self signed CA certificate so you need to import this or install this on the servers as well for maintaining the chain of trust. For trusted root CA you don't need to do this because it is already present on computer systems and browsers trusted CA store. 

Avi