Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

To test some stuff I need to create a bunch of untrusted p12 certificates to be used by untrusted web-server. I read openssl documentation and tried to follow the instructions but the process is very complicated, aggravating and error prone. Is there an easy way (GUI, web application) to get a server certificate with arbitrary subject signed by untrusted, fake CA.

Naked OpenSSL command line tool is not an option because the process is complicated and error-prone. If there is a script that simplifies it I would like to hear.

share|improve this question
up vote 2 down vote accepted

If a script that simplifies it is enough, then:


subject="/O=Honest Achmed/OU=Fake Certs/"

Issue a self-signed certificate (with CA bit enabled):

openssl req -new -newkey rsa:2048 -days 365 -subj "$subject" \
    -x509 -out "$file.pem" -keyout "$file.key" -nodes

Issue a CA-signed certificate:

openssl req -new -newkey rsa:2048 -days 365 -subj "$subject" \
    -out "$file.csr" -keyout "$file.key" -nodes

openssl x509 -req -in "$file.csr" -out "$file.pem" \
    -CA "$cafile.pem" -CAkey "$cafile.key" -CAserial "serial.txt"

Export to PKCS#12:

openssl pkcs12 -export -in "$file.pem" -inkey "$file.key" -out "$file.p12"

Alternative tools are certtool from GnuTLS and hx509 from Heimdal.

share|improve this answer
Thanks it worked (after changing file to cafile in first command) – Muxecoid Feb 12 '12 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .