How to build a certifcate chain for ServerHello

Question

I've been trying to put together a certificate chain. I have the private key (privatekey.pem) and CSR (csr.pem) that I submitted to the Certificate Authority/CA.

I took the CA's certificate and put the contents in a file (ca.crt). The ca.crt starts with a -----BEGIN CERTIFICATE----- line and then the hashed stuff. I still need the certificate chain though, and looking at the certificate chain example here http://docs.aws.amazon.com/IAM/latest/UserGuide/InstallCert.html#SampleCert

I assume that what I have in the privatekey.pem is the root certificate (right?) and ca.crt is the intermediate certificate 1 in the sample chain in that link. If that's the case how/where do I get the other intermediate certificate? If I'm misunderstanding this, what or how do I get/generate the order?

Answer 1

You seem to be mixing up several aspects here. What you need to get the final result is

1. your private key
2. the root certificate, which is equal for everybody using the same CA (that is what your ca.crt seems to be)
3. a/some intermediate certificates, usually found on the CA's site
4. the result of the submitted CSR, which then is your certificate.

2-4 make up the certificate chain.

Answer 2

Adron,

the privatekey.pem is the private key for the cert that you requested from the CA.

the root ca cert will be the certificate from the top of the particular PKI that issued your cert and will be a self signed cert.

the intermediate ca certs are from sub-ca's below the root CA.

e.g. example.com has a root CA call exampleRootCA and a sub CA called exampleSubCA.

exampleSubCA issues you an SSL cert AdronSSL

your certificate chain will be AdronSSL -> exampleSubCA -> exampleRootCA

hope this helps

Answer 3

Below Commands 1-5 helps in creating the Certificate Chain

1. Command to Create RootCA's Private Key and Self Signed Certificate

   openssl req -new -nodes -newkey rsa:2048 -sha256 -days 100 -keyout rootPrivateKey.key -x509 -out rootCACertificate.pem

Note: Command to convert RootCA Certificte from .crt to .pem format

openssl x509 -outform pem -in rootCACertificate.pem -out rootCACertificate.crt

2. Command to Create Intermediate CA's Private Key and it's Certificate Sign Request

   openssl req -new -nodes -newkey rsa:2048 -keyout intermediateCAPrivateKey.key -out intermediateCACertificateSignRequest.csr

3. Command to Create Intermediate CA's Certificate Signed by RootCA

   openssl x509 -req -sha256 -days 100 -in intermediateCACertificateSignRequest.csr -CA rootCACertificate.pem -CAkey rootPrivateKey.key -CAcreateserial -extfile domain.ext -out intermediateCACertificate.crt

Contents of domain.ext is provided below:

subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

4. Command to Create Server's Private Key and Sign Request

   openssl req -new -nodes -newkey rsa:2048 -keyout serverPrivateKey.key -out serverSignRequest.csr

5. Command to Create Server's Certificate Signed by IntermediateCA

   openssl x509 -req -sha256 -days 100 -in serverSignRequest.csr -CA intermediateCACertificate.crt -CAkey intermediateCAPrivateKey.key -CAcreateserial -extfile domain.ext -out serverCertificate.crt

Contents of domain.ext is provided below:

basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [ alt_names ] DNS.1 = localhost

Note: Command to convert Server's Private Key in .key Format to .PEM format.

openssl rsa -in serverPrivateKey.key -out serverPrivateKey.pem

Here the Root CA is Self Signed. Thus Browsers doesn't recognize it. To ensure Browser recognise, open IE ->Tools->Internet Options -> Content -> Import the Root CA in Trusted Certification Authority Section and the Intermediate CA in Intermediate Certification Authority Section.

The Server Certificate and Server's Private Key is kept in Server you run serve the web pages.

Once you request for webpages, you can find the Server Certificate gets validated against the Certificate Chain