Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We are looking for a simple solution where we can create digital ID of our staff member [3-4] only. And then we install their ID in Outlook and can use to send encrypted and digitally signed Emails.

I try to create Certificate using couple of tools, but none work as digital ID. I am not very expert of it or really understand the topic. But I can use super user level tools, if someone guide me in right direction.

In short I only need to know how to create Self Signed Digital ID. Thanks.

share|improve this question
    
Despite my answer, I'd really suggest looking into establishing your own internal CA—even for only three or four users. Firstly, you'll only need to install one certificate on all machines, instead of three or four; secondly, three or four easily becomes eight or ten in six month's time and a solution like this can easily get out of hand. Having a CA also lets you revoke certificates when people leave, lose their key, etc. –  Calrion Oct 17 '13 at 0:48

1 Answer 1

You can create a self-signed certificate with OpenSSL using the following command:

openssl req -x509 -newkey rsa:2048 -days 365 -keyout private-key.pem -out certificate.pem

This will create a new 2048-bit RSA key and a new self-signed certificate based on that key, which will be valid for one year. To use the certificate with Microsoft Outlook, you may need a PKCS#12 file, which can be created by running the following once the above has been successful:

openssl pkcs12 -export -inkey private-key.pem -in certificate.pem -out my-digital-id.p12

In the above commands, private-key.pem is the private key file (which my system insisted be encrypted, and which you need to keep secret to the user), certificate.pem is the freely-distributable certificate that all recipients will need to trust, and my-digital-id.p12 is a PKCS#12 file containing both the key and certificate. PKCS#12 files are commonly used on Microsoft platforms for importing and exporting certificates and keys.

If you want to change the way the certificate is generated, what extensions are included, etc., then I suggest taking a look at the req, x509, and x509v3_config pages in the OpenSSL manual.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.