I would like to set up my own OCSP Responder for testing purposes, and this requires me to have a Root certificate with a few certificates generated from it.

I've managed to create a self-signed certificate using openssl, and I want to use it as the Root certificate. The next step would be to create the derived certificates, however, I can't seem to find the documentation on how to do this. Does anyone know where I can find this information?

  • Edit:
    In retrospect, my question is not yet completely answered, and to clarify the problem, I'll represent my certificate chain like this: Root > A > B > C > ...

I am currently able to create the Root and A certificates via the below, but I haven't found how to make a longer chain:

# Root certificate is created like this:
  openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key
  openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem

# Certificate A is created like this:
  openssl genrsa -out client.key 1024
  openssl req -new -key client.key -out client.csr
  openssl ca -in client.csr -out client.cer
  • This command implicitly depends on the root certificate, for which it finds the required info within the OpenSSL configuration file, however, certificate B must only rely on A, which is not registered in the config file, so the previous command won't work here.

What command should I use to create certificates B and beyond?

  • Edit:
    I found the answer in this article: Certificate B (chain A -> B) can be created with these two commands and this approach seems to be working well.:

    # Create a certificate request
    openssl req -new -keyout B.key -out B.request -days 365
    # Create and sign the certificate
    openssl ca -policy policy_anything -keyfile A.key -cert A.pem -out B.pem -infiles B.request

    I also changed the openssl.cnf file:

    [ usr_cert ]
    basicConstraints=CA:TRUE # prev value was FALSE

You can use OpenSSL directly.

  1. Create a Certificate Authority private key (this is your most important key):

    openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key
  2. Create your CA self-signed certificate:

    openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem
  3. Issue a client certificate by first generating the key, then request (or use one provided by external system) then sign the certificate using private key of your CA:

    openssl genrsa -out client.key 1024
    openssl req -new -key client.key -out client.csr
    openssl ca -in client.csr -out client.cer

(You may need to add some options as I am using these commands together with my openssl.conf file. You may need to setup your own .conf file first.)

| improve this answer | |
  • Thanks, you instructions worked after some tweaking of my openssl.conf file. – StackedCrooked Apr 1 '10 at 7:59
  • 3
    @twk: note the question has one more step needed for a complete answer -- how to create another certificate that only depends on the certificate created in step 3, but not the root certificate. – quack quixote Apr 7 '10 at 19:08
  • 6
    Fails at last step with "unable to load CA private key"; I can get partway there by supplying the key and cert with openssl ca -in client.csr -out client.cer -cern ca.pem -keyfile ca.key, but it wants a demoCA directory and various accouterments. – Iiridayn Jun 28 '17 at 20:28
  • 36
    "You may need to add some options..." really removes the utility from this answer. – Zach Feb 8 '18 at 18:52

Once you have created your CA, you can use it to sign certs:

  • Create a key:
    openssl genrsa -out key_A.key  1024
  • Create a CSR:
    openssl req -new -key key_A.key -out csr_A.csr
      # You are about to be asked to enter information etc....
  • Sign it:
    openssl x509 -req -days 365 -in csr_A.csr -CA CA_certificate_you_created.crt \
    -CAkey CA_key_you_created.key -set_serial 01 -out crt_A.crt
    And so on, replacing A with B, CA_certificate_you_created.crt with crt_A.crt, and CA_key_you_created.key with key_A.key

Changing the below means that the certificates you issue can be used to sign other certificates:

basicConstraints=CA:TRUE  # prev value was FALSE
| improve this answer | |
  • thx, very helpful – flotto Mar 27 '17 at 7:59
  • 1
    What .crt file? – MickyD Oct 1 '18 at 5:12

OpenSSL comes with a Perl script CA.pl to help you create a self-signed root CA cert, along with the matching private key, plus a few simple files and directories to help keep track of any future certs you sign (a.k.a. issue) with that root CA. It also helps you generate other key pairs and certificate signing requests (CSRs) and helps you process those CSRs (that is, issue certs for them), and more.

Note that many products require CA certs to contain a certain attribute marking them as CA certs, or they won't be accepted as valid signers/issuers of other certs. If the self-signed cert you created does not contain that attribute, you might have trouble getting other software to treat it like a valid root CA cert.

If I recall correctly, the syntax goes something like this:

CA.pl -newca    # Create a new root CA  

CA.pl -newreq   # Create a new CSR

CA.pl -sign     # Sign a CSR, creating a cert  

CA.pl -pkcs12   # Turn an issued cert, plus its matching private key and trust chain, 
                # into a .p12 file you can install on another machine    
| improve this answer | |
  • 4
    This was helpful. On Ubuntu 14.04 I found the file at /usr/lib/ssl/misc/CA.pl – Colin M Jan 25 '17 at 22:00

Here's the simplest solution I found.



cd "$(mktemp -d)"

# Create CA
openssl req -newkey rsa:4096 -keyout "${caPk}" -x509 -new -nodes -out "${ca}" \
  -subj "/OU=Unknown/O=Unknown/L=Unknown/ST=unknown/C=AU" -days "${certValidityDays}"

# Create Cert Signing Request
openssl req -new -newkey rsa:4096 -nodes -keyout "${certPk}" -out csr.pem \
       -subj "/CN=${host}/OU=Unknown/O=Unknown/L=Unknown/ST=unknown/C=AU" 

# Sign Cert
openssl x509 -req -in csr.pem -CA "${ca}" -CAkey "${caPk}" -CAcreateserial -out "${cert}" \
       -days "${certValidityDays}"
  • Essentially only three commands.
  • I introduced some variables to make the commands easier to understand.
  • What you will need on your webserver are: cert, certPk and ca.
  • caPk is only needed if you want to sign more certs.
  • runs without interaction, so it can be used in batch process.
  • If you want interaction, just leave out the -subj parts.

Some more hints

  • You could run those steps within a standardized debian environment like so:
docker run --rm -it debian:buster-20200327-slim bash
apt update && apt install openssl #=1.1.1d-0+deb10u2
# Run steps above, then `exit` - the certs are stored in a subfolder in your current directory
| improve this answer | |

I found this post on Stack Overflow and it's for Node.JS, but the script in this GitHub repo uses openssl commands to create a root CA and Domain cert.

Run using:

  • example.com: bash make-root-ca-and-certificates.sh 'example.com'
  • localhost: bash make-root-ca-and-certificates.sh 'localhost'



# make directories to work from
mkdir -p certs/{server,client,ca,tmp}

# Create your very own Root Certificate Authority
openssl genrsa \
  -out certs/ca/my-root-ca.key.pem \

# Self-sign your Root Certificate Authority
# Since this is private, the details can be as bogus as you like
openssl req \
  -x509 \
  -new \
  -nodes \
  -key certs/ca/my-root-ca.key.pem \
  -days 1024 \
  -out certs/ca/my-root-ca.crt.pem \
  -subj "/C=US/ST=Utah/L=Provo/O=ACME Signing Authority Inc/CN=example.com"

# Create a Device Certificate for each domain,
# such as example.com, *.example.com, awesome.example.com
# NOTE: You MUST match CN to the domain name or ip address you want to use
openssl genrsa \
  -out certs/server/privkey.pem \

# Create a request from your Device, which your Root CA will sign
openssl req -new \
  -key certs/server/privkey.pem \
  -out certs/tmp/csr.pem \
  -subj "/C=US/ST=Utah/L=Provo/O=ACME Tech Inc/CN=${FQDN}"

# Sign the request from Device with your Root CA
# -CAserial certs/ca/my-root-ca.srl
openssl x509 \
  -req -in certs/tmp/csr.pem \
  -CA certs/ca/my-root-ca.crt.pem \
  -CAkey certs/ca/my-root-ca.key.pem \
  -CAcreateserial \
  -out certs/server/cert.pem \
  -days 500

# Create a public key, for funzies
# see https://gist.github.com/coolaj86/f6f36efce2821dfb046d
openssl rsa \
  -in certs/server/privkey.pem \
  -pubout -out certs/client/pubkey.pem

# Put things in their proper place
rsync -a certs/ca/my-root-ca.crt.pem certs/server/chain.pem
rsync -a certs/ca/my-root-ca.crt.pem certs/client/chain.pem
cat certs/server/cert.pem certs/server/chain.pem > certs/server/fullchain.pem
| improve this answer | |

The best answer can be found here - https://www.youtube.com/watch?v=KXi3-3dEb8k

I have modified it to suit needs by making the intermediate certificate's CA basic constraint True:


[ req ]
distinguished_name       = distinguished_name
extensions               = int_ca
req_extensions           = int_ca

[ int_ca ]
basicConstraints         = CA:TRUE

[ distinguished_name ]

#create Root CA
openssl genrsa -out RootCA.key 4096
openssl req -new -x509 -days 1826 -key RootCA.key -out RootCA.pem -subj "/C=US/O=xzy/OU=abc/CN=ROOT-CN"

#create Intermediate CA
openssl genrsa -out IntermediateCA.key 4096
openssl req -new -sha256 -key IntermediateCA.key -nodes -out IntermediateCA.csr -subj "/C=US/O=xyz/OU=abc/CN=INTERIM-CN"
openssl x509 -req -days 1000 -extfile MyOpenssl.conf -extensions int_ca -in IntermediateCA.csr -CA RootCA.pem -CAkey RootCA.key -CAcreateserial -out IntermediateCA.pem

#create EndUser certificates
openssl genrsa -out my_server.key 2048
openssl req -new -key my_server.key -out my_server.csr -subj "/C=US/O=xyz/OU=abc/CN=USER-CN"
openssl x509 -req -in my_server.csr -CA IntermediateCA.pem -CAkey IntermediateCA.key -set_serial 01 -out my_server.pem -days 500 -sha1
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.