Skip to main content

Self signed CA and CSR basics

 In pki - public key infrastructure, CA is responsible for issuing and maintaining digital certificates. They actually sign the certificate with their private key and then it becomes digital signature. They are called trusted RootCA.

But what if you don't have trusted rootca? 

In that case you need to create your own self signed CA that involves generating private key. Once the CA has been created now using this CA you can sign other certificates in your organization. Which will be called issued by this CA. Once the CA has been created then it needs to be distributed to all clients and servers who needs to trust this, this also maintain chain of trust. The process as follows:

Install openssl:

sudo apt-get install openssl

Generate the private key:

openssl genrsa -out ca.key 2048

Create new CA certificate:

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -sha256

Protect the private key:

chmod 400 ca.key

That's it. Your CA certificate has been created. You can use this certificate to sign other certificates and use ca.key and ca.crt for your certificate signing process. 

You can generate new CA certificate for several reasons. One of the reason is say your previous CA certificate was issued using sha1 algorithm which is obsolete now. If this old CA was used to sign your other certificates then you need to replace this. 

For replacing old certificates with new one or if it is completely new request for your server, in both the cases CSR - certificate signing request you need to perform. If you want your server should get a certificate signed by self signed CA, then you need to generate a csr request for your server. That CSR request contains your server address host.example.com or for whole domain name like this *.example.com along with a public key. 

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr

After CA receive this, then it will sign that (after verifying) with CA's private key. Then give back to you as your digital certificate. 

Now final task is you need to install both i mean, CA certificate and your server certificate on the same machine/server where you want to install certificate. And CA certificate also need to install because maintaining the chain of trust. 

As this is self signed CA certificate so you need to import this or install this on the servers as well for maintaining the chain of trust. For trusted root CA you don't need to do this because it is already present on computer systems and browsers trusted CA store. 

Avi


Comments

Post a Comment

Popular posts from this blog

Installing Codename SCNR web application scanner on ubuntu | kali

  Perform the following steps from a non-root user. We will go for manual installation.  https://github.com/scnr/installer?tab=readme-ov-file#manual-installation https://github.com/scnr/installer/releases wget https://github.com/scnr/installer/releases/download/v1.7.3/scnr-v1.7.3-linux-x86_64.tar.gz   (Download using normal user) tar -xvzf scnr-v1.7.3-linux-x86_64.tar.gz cd scnr-v1.7.3 cd bin Now go to their website ( https://ecsypno.com/products/scnr ) and subscribe for community edition license from your official email.  ./scnr_activate 6XQ97FW3LVBECD0UJ5H214 ./scnr https://www.example.net/Login.aspx --system-slots-override Now they generate .ser format report after testing the application by default which is hard to read. We need html report. So for example, to generate an HTML report: ./scnr_reporter --report=html:outfile=my_report.html.zip /home/user/.scnr/reports/report.ser Avi
Post a Comment
Read more

Install Nessus from docker

Docker installation. Give the below commands one by one. apt install docker-cli or apt install docker.io After the installation is complete, if you are inside wsl then give this command to start docker, because inside wsl systemd (systemctl) does not work: service docker start WSL troubleshooting : If the above command " service docker start " does not work then use below command: dockerd (It may not work if any previous docker process is running. It will show you pid of that process. Use this command to kill that process " kill -9 pid " and run dockerd command again) If " docker ps -a " giving error like " Cannot connect to the Docker daemon at unix:///run/podman/podman.sock. Is the docker daemon running? " This is because you may installed podman-docker package. If you remove the package still you will get this error but you should remove the package. Then issue this command: env | grep -i docker DOCKER_HOST=unix:///run/podman/podman.sock   --...
Post a Comment
Read more

Downloading kape incident response tool for forensic triage

 Kape is a triage collection and post-processing application written by Eric Zimmerman. Remember its just the triage collection tool ok? We will analyze the collection later.  https://github.com/EricZimmerman/KapeFiles Kape download: Kroll Artifact Parser And Extractor (KAPE) | Cyber Risk | Kroll Besides full disk image/acquired disk image, this tool allows us to create smaller triage image where important forensic data is present . In case the scenario is divide and conquer , meaning if you want smaller triage image from big size disk image then you can use this and share with your DFIR team to investigate together. The main reason of using kape is now you don't need to wading or sift through into the full image where 10% actual artifacts are present. Kape will allow you to collect those 10% before taking full image. Now you can analysis those 10% of data.  If you want to learn more, please open for508 workbook and labs section 1-2.pdf file and look for page 28. This is...
Post a Comment
Read more