I would like to setup my own OCSP Responder (just for testing purposes). This requires me to have a root certificate and a few certificates generated from it.
I've managed to create a self-signed certificate using openssl. I want to use it as the root certificate. The next step would be to create the derived certificates. I can't seem to find the documentation on how to do this however. Does anyone know where I can find this information?
In retrospect, my question is not yet completely answered. To clarify the problem I'll represent my certificate chain like this:
ROOT -> A -> B -> C -> ...
I am currently able to create the ROOT and A certificates, but I haven't found out how to make a longer chain.
My command for creating the root certificate is:
openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem
Certificate A is created like this:
openssl genrsa -out client.key 1024 openssl req -new -key client.key -out client.csr openssl ca -in client.csr -out client.cer
This command implicitly depends on the root certificate, for which it finds the required info in the openssl configuration file.
Certificate B however must only rely on A, which is not registered in the config file, so the previous command won't work here.
What command line should I use to create certificates B and beyond?
I found the answer in this article. Certificate B (chain A -> B) can be created with these two commands:
# Create a certificate request openssl req -new -keyout B.key -out B.request -days 365 # Create and sign the certificate openssl ca -policy policy_anything -keyfile A.key -cert A.pem -out B.pem -infiles B.request
I also changed the openssl.cnf file:
[ usr_cert ] basicConstraints=CA:TRUE # prev value was FALSE
This approach seems to be working well.