Certificates, issue

To create a certificate we need a signing request. The default configuration (openssl) file is sane enough, so we use it. FIXME Explain some question here …

$ cd /tmp/
$ openssl req -newkey rsa:1024 -keyout tchetchWWWkey.pem -keyform PEM -out tchetchWWWreq.pem -outform PEM
  Generating a 1024 bit RSA private key
  ........++++++
  .++++++
  writing new private key to 'tchetchWWWkey.pem'
  Enter PEM pass phrase:
  Verifying - Enter PEM pass phrase:
  -----
  You are about to be asked to enter information that will be incorporated
  into your certificate request.
  What you are about to enter is what is called a Distinguished Name or a DN.
  There are quite a few fields but you can leave some blank
  For some fields there will be a default value,
  If you enter '.', the field will be left blank.
  -----
  Country Name (2 letter code) [AU]:CH
  State or Province Name (full name) [Some-State]:Valais
  Locality Name (eg, city) []:Martigny
  Organization Name (eg, company) [Internet Widgits Pty Ltd]:Tchetch
  Organizational Unit Name (eg, section) []:Tchetch Web
  Common Name (eg, YOUR name) []:www.tchetch.net
  Email Address []:tchetch@i-james.com 
  
  Please enter the following 'extra' attributes
  to be sent with your certificate request
  A challenge password []:
  An optional company name []:

Now we can sign our certificate :

  $ openssl ca -config /opt/ca/tchetchCA.cnf -in tchetchWWWreq.pem -out tchetchWWWcert.pem
  Using configuration from /opt/ca/tchetchCA.cnf
  Enter pass phrase for /opt/ca/private/cakey.pem:
  Check that the request matches the signature
  Signature ok
  The Subject's Distinguished Name is as follows
  countryName           :PRINTABLE:'CH'
  stateOrProvinceName   :PRINTABLE:'Valais'
  localityName          :PRINTABLE:'Martigny'
  organizationName      :PRINTABLE:'Tchetch'
  organizationalUnitName:PRINTABLE:'Tchetch Web'
  commonName            :PRINTABLE:'www.tchetch.net'
  emailAddress          :IA5STRING:'tchetch@i-james.com'
  Certificate is to be certified until Sep 22 15:56:36 2009 GMT (365 days)
  Sign the certificate? [y/n]:y
  
  
  1 out of 1 certificate requests certified, commit? [y/n]y
  Write out database with 1 new entries
  Data Base Updated

The file tchetchWWWreq.pem can be removed now. The two files needed are tchetchWWWcert.pem and tchetchWWWkey.pem. The key most be kept as safe as possible, if it's lost your security is compromised !