CA Server - OpenSSL

In this video, we show how to create a Certificate Authority Server using OpenSSL
A number of IT devices are managed through a web browser but these are supplied with a self-signed certificate
Aside from the annoying warning from the web browser that the certificate is not trusted, it's not a good security practice to use self-signed certificates
Instead, if you only use signed certificates from a certificate authority your web browser trusts, you are much more likely to spot a suspicious web site, whether private or public and avoid it
Once set up properly, the CA server can issue certificates to computers on your network and you can then connect to them securely through a web browser
We will be using an Ubuntu server for this installation but OpenSSL is available on other platforms
NOTE: In a large environment it is best to set up intermediary CA servers as well
However, given the lack of interest the likes of Google has in certificate revocation, we will only create a Root CA
Because if the intermediary server is compromised, it would be easier to replace the Root CA
NOTE: Google Chrome web browser insist on a Subject Alternate Name in the certificate, even if the server has only one name
Useful links:
www.openssl.org/docs/manpages...
www.openssl.org/docs/manmaste...
www.openssl.org/docs/man1.0.2...
www.openssl.org/docs/manmaste...
www.openssl.org/docs/man1.0.2...
=============================
SUPPORT THE CHANNEL
Donate through Paypal:
paypal.me/DavidMcKone
Donate through Buy Me A Coffee:
buymeacoffee.com/dmckone
Become a monthly contributor on Patreon:
/ dmckone
Become a monthly contributor on KZbin:
/ @techtutorialsdavidmckone
==============================
==============================
MEDIA LINKS:
Website - www.techtutorials.tv/
Twitter - / dsmckone1
Facebook - / dsmckone
Linkedin - / dmckone
Instagram - / david.mckone
==============================
Steps taken:
1) Create the Root CA VM
Create a VM to install Ubuntu server for instance
(1vCPU, 1GB RAM, 16GB HDD, 1vNIC)
During the install process, opt to encrypt the disk and to install OpenSSH
However, do not install any other applications when prompted
2) Basic configuration
After enabling UFW, create folders for the CA
mkdir -p ca/{private,certs,newcerts,csr}
chmod -v 700 ca/private
Create an index file and serial file for the CA
touch ca/index
openssl rand -hex 16 ca/serial
NOTE: Check the video as the last line is missing redirect symbol which the description box does not accept
3) Create the Root CA private key
cd ca
openssl genrsa -aes256 -out private/root-ca.key 4096
4) Create the CA config file
See comment
5) Create the root CA self-signed certificate
openssl req -config root-ca.conf -extensions v3_ca -key private/root-ca.key -new -x509 -days 3650 -out certs/root-ca.crt
6) Create a server private key
openssl genrsa -out private/testserver.key 2048
7) Create a server CSR, using a config file
See comment
openssl req -new -key private/testserver.key -sha256 -out csr/testserver.csr -config csr/testserver-csr.conf
Check for the SAN
openssl req -noout -text -in csr/testserver.csr | grep -A 1 "Subject Alt"
8) Sign the server certificate request
openssl ca -config root-ca.conf -notext -in csr/testserver.csr -out certs/testserver.crt -extensions req_ext -extfile csr/testserver-csr.conf
Check for the SAN
openssl x509 -text -noout -in certs/testserver.crt | grep -A 1 "Subject Alt"
9) Configure web browser to trust the root CA
Firefox
Settings | Privacy & Security | View Certificates | Authorities | Import
Brave
Settings | Privacy & Security | Security | Manage certificates | Authorities | Import
10) Upload private key and certificate to the server, configure it to use these, then test on web browser
=====================================
Credits:
LoveLife | Instrumental Prod. Blue Mango | EQMUSEQ.COM by Don Da Vinci
soundcloud.com/eqmuseq/loveli...
openssl install,openssl install linux,openssl install ubuntu,openssl config file,ssl certificate,certificate authority,openssl ubuntu,openssl install ubuntu 20.04,openssl ubuntu 20.04,openssl ubuntu 20.04 install,ca server,certificate authority server,openssl ca server,openssl certificate authority server,how to create ca server,how to create certificate server,openssl,openssl installation
00:00 Intro
01:56 Timelines
02:30 Why create a CA?
08:09 How it works
13:20 Virtualization
16:00 Certificate revocation
24:08 Build VM
28:27 Initial set up
39:30 CA private key
49:34 Open SSL config file
59:28 CA certificate
01:11:40 Server private key
01:14:04 Server CSR
01:21:15 Sign CSR
01:30:34 Install Root certificate and test
CA Server - OpenSSL

[@TechTutorialsDavidMcKone]

Config files used in the video below... NOTE: The policy has since been changed and match is not used for the Organization name. This is because some CSRs were found to cause problems when signing, where even though the Organization name was the same, openssl generated an error saying they didn't match *** root-ca.conf *** [ ca ] # 'man ca' # Used by the ca command default_ca = CA_default [ CA_default ] # Directory and file locations dir = . certs = $dir/certs new_certs_dir = $dir/newcerts database = $dir/index serial = $dir/serial RANDFILE = $dir/private/.rand # RANDFILE is for storing seed data for random number generation # Root CA certificate and key locations certificate = $dir/certs/root-ca.crt private_key = $dir/private/root-ca.key # Default message digest, we'll opt for SHA2 256bits default_md = sha256 name_opt = ca_default cert_opt = ca_default default_days = 365 preserve = no policy = policy_strict [ policy_strict ] countryName = supplied stateOrProvinceName = supplied organizationName = supplied organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] # 'man req' # Used by the req command default_bits = 2048 distinguished_name = req_distinguished_name string_mask = utf8only default_md = sha256 # Extensions to use for -x509 x509_extensions = server_cert [ req_distinguished_name ] # Certificate signing request countryName = Country Name (2 letter code) stateOrProvinceName = State or Province Name localityName = Locality Name organizationName = Organization Name organizationalUnitName = Organizational Unit Name commonName = Common Name emailAddress = Email Address # Defaults countryName_default = GB stateOrProvinceName_default = England organizationName_default = TempLab [ v3_ca ] # ' man x509v3_config' # Extensions for root CA subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:TRUE keyUsage = critical, digitalSignature, cRLSign, keyCertSign [ usr_cert ] # `man x509v3_config` # Extensions for client certificates basicConstraints = CA:FALSE nsCertType = client, email nsComment = "OpenSSL Generated Client Certificate" subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment extendedKeyUsage = clientAuth, emailProtection [ server_cert ] # Extensions for server certificates basicConstraints = CA:FALSE nsCertType = server nsComment = "OpenSSL Generated Server Certificate" subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer:always keyUsage = critical, digitalSignature, keyEncipherment extendedKeyUsage = serverAuth --- *** csr/testserver-csr.conf *** [ req ] # 'man req' # Used by the req command default_bits = 2048 distinguished_name = req_distinguished_name req_extensions = req_ext prompt = no [ req_distinguished_name ] # Certificate signing request countryName = GB stateOrProvinceName = England organizationName = TempLab commonName = test.templab.lan [ req_ext ] subjectAltName = @alt_names [ alt_names ] DNS.1 = test.templab.lan IP.1 = 172.16.21.20

[@charles.oliveira]

How come you don't have thousands subscribers and views??? This video is BY FAR the best I've found out regarding OpenSSL for PKI. Thank you sir for your video!

[@TechTutorialsDavidMcKone]

I've no idea what does and doesn't get view counts up these days, but at the end of the day, as long as someone finds a video useful, that's enough for me Anyway, thanks for the feedback, it's really appreciated. And glad to hear you found the video helpful

[@DVMovies1999]

@@TechTutorialsDavidMcKone Can’t agree more with Charles! I’ve got some knowledge about certificates but not with setting up my own PKI. Always got some error and didn’t find out why. This video really helped with making the whole process much more clear. Thank you so much for your time and knowledge David 🙂

[@TechTutorialsDavidMcKone]

That's really good to know so thanks for the feedback

[@bambam0099]

One thing I have always hated when attending training courses is how the instructors have you enter commands but never explain why. Your comments are priceless and greatly appreciated. Not only are you easy to follow but more importantly, it's easy to understand why. Thank you for putting in the time for making the videos!

[@TechTutorialsDavidMcKone]

Thanks for the feedback And good to know the video was helpful

[@digitalpunkdaft]

David, I struggled for over 3-4 months to create my own CA server, thank you for sharing this knowledge and for explaining everything so well. I really appreciate your work and knowledge, greetings from Mexico

[@TechTutorialsDavidMcKone]

openSSL can be confusing to use as a CA but it's very useful for internal use So glad to hear the video was helpful

[@1908gonzo]

Excellent job on this video. So very helpful. the SSL world can get really complicated with Self Signed CA and Server Keys and Certificates. You've helped make it so much more clear.

[@TechTutorialsDavidMcKone]

Thanks for the feedback, always appreciated

[@jonathanrider4417]

Thank you for this David! This subject is not generally covered very well in my opinion (novice) - your explanations, while somewhat lengthy, are very illuminating to me. Certificates have been a big mystery to me and all of this is very helpful. I hope to be signing some certificates soon thanks to you!

[@TechTutorialsDavidMcKone]

Thanks for the feedback, much appreciated Good to know the video has been helpful

[@DrLevi1000]

Hi David, Also from me a big thank you for the excellent video about certificates. It helped me a lot understanding the whole process of certificate handling. I guess this detailed 1h40min+ video took you easily one day :) Thanks and enjoy your coffee :) Mark

[@TechTutorialsDavidMcKone]

Thanks very much Mark It's greatly appreciated

[@itssoaztek4592]

Thank you for your effort to provide a great resource on openssl !! It helped me immensely to make my private network more secure.

[@TechTutorialsDavidMcKone]

Thanks for the feedback, always appreciated And good to hear you found the video helpful

[@user-eo5cm3vz9c]

Добрый день! Класс, все получилось! Спасибо Вам большое!

[@TechTutorialsDavidMcKone]

Good to know the video helped. Thanks for the feedback

[@flymoracer]

Really interesting post, thanks. Its true that revocation, at least for internet browsers, is currently broken, but there are very valid use cases where it can still be useful. For the purposes of a private home lab CA this solution is perfect. Nice and simple, assuming a basic level understanding on how certificates and CA's work, and doesnt require a private CA infrastructure, which would be overkill in this situation. In a business setting though I'd really consider the security implications as this approach does ignore some of the widely accepted good practice. Also, beyond a really small implementation I'd suggest that its too labour intensive and prone to errors. If you're issuing certificates for any public facing servers then there are great solutions from the likes of Lets Encrypt, but thats a different use case. Great video.

[@TechTutorialsDavidMcKone]

Thanks for the feedback, really appreciated The problem with certificate revocation is it's no longer supported by the likes of Google Chrome, or at least not when it involves a private CA as they've adopted a different strategy For public use, there's certainly no gain in using something like this, especially when the whole process can now be automated So this is more for internal use as unless you have public facing servers, the validation still requires giving away private information which has never been a good idea

[@krishnaspicy]

Great Video! I have implemented Internal certificate Authority in our environment. It is working well. Good explanation. Once again, thank you.

[@TechTutorialsDavidMcKone]

That's great to hear. I really appreciate the feedback

[@pama1]

Content is awesome, will be trying this in my lab later this week. One improvement would be to use bigger font or zoom into the work area to read more easily.

[@TechTutorialsDavidMcKone]

Thanks for the feedback it's really appreciated

[@user-vb5tt4io1c]

hi David ive setup a rootca and setup apache with the server certificates however im using an ip address and my browser isnt trusting the connection despite installing the rootca.crt to the web browsers certificate store. my question is do i need to setup a dns server before setting this up?

[@TechTutorialsDavidMcKone]

You can have a certificate based on an IP address But usually you tie it to the fully qualified domain name and add the IP address as a subject alternate name to allow you to use both And although a DNS server helps, you can also just edit the hosts file on a computer and use that to resolve the FQDN

[@alphenit]

Thank for this great tutorial @Tech Tutorials - David McKone! Was wondering: If somehow you had problems with your ca server vm (for example upgrading linux doesn't go well) and you decide you want a new server VM, do you just install a new VM and copy over everything in /home/caadmin to the new server and all is well or is it more complicated than that?

[@TechTutorialsDavidMcKone]

Because it's a VM you can take a snapshot before doing any upgrades and roll it back if things go bad But if for some reason you wanted a different computer, then you can just copy across the contents across

[@alphenit]

@@TechTutorialsDavidMcKone For sure. I installed it on a minimal ubuntu machine but have been looking at NixOS also so might need to migrate at some point :) Another question: Do you always need to create a csr/device.conf if you need to create a new cert for a new device? Or is uploading the csr from the target device enough? Guess I don't understand that bit well enough. When you create a CSR for VMware vCenter for example you have to mandatory fill out all the fields anyway so don't grasp what the conf file brings you extra?

[@TechTutorialsDavidMcKone]

@@alphenit Web browsers like Google Chrome need a Subject Alternate Name in the certificate Even though that will probably be in the CSR, OpenSSL ignores it So you need an extra file for OpenSSL to read the SAN details from to get a signed certificate with includes the SAN

[@alphenit]

@@TechTutorialsDavidMcKone ah I see now, thank you, subscribed!

[@HusseinHussein0x7]

I already have servers with IIS and paid SSL Certificate does implementing OpenSSL effect the certificate on those servers?

[@TechTutorialsDavidMcKone]

As far as I'm aware a web server can only use one certificate for a website But a web server can host multiple websites, each with their own certificate

[@sidneyking11]

@Tech Tutorial, I am thinking about setting up a RootCA ubuntu server. My chrome browser has issues connecting to my internet webserver or other admin pages on the inside of my network. Certificates is still difficult to get the browser to behave right if it gets a self signed certificate. At lease the sarfai browser would give the error but does give an option to access the website. I have not had a change to view your video completely, does it cost to get a legit certificate or make my server a RootCA? I would like to make everything on my network to require https: Not being a experience Linux person, sometimes its difficult to follow all the steps. Thank you

[@TechTutorialsDavidMcKone]

Part of the problem with using a public certificate authority is that you need to own a domain and they need to check a server is legitimate so they would want access to a public facing server I have worked with companies that had public servers who purchased wildcard certificates to then use internally on any internal device As I don't have a public server and due to the costs, I opted for an internal root CA

[@marinatyres7630]

Very informative video.. I have a OpenSSL query.. if you can help.. In the 'ecstresstest' I want to know the key value of 'kP256DefaultResult' if I set NUM_REPEATS equals 100 only.. can you tell me how to find that?

[@TechTutorialsDavidMcKone]

I haven't done any stress testing so I can't help unfortunately

[@sidneyking11]

In your video at 50:00 you reference a root-ca.conf file. Where to locate this file? I do not see it in my ca folder. thank you

[@TechTutorialsDavidMcKone]

It's the base config file for the Root CA server and you have to create this Check my pinned comment for this as the description wouldn't accept it

[@nonkelsue]

@@TechTutorialsDavidMcKone Where can this 'pinned comment' be found? I must be overlooking it...

[@TechTutorialsDavidMcKone]

​@@nonkelsue Not sure if I forgot to pin it but it is now, so it's at the top of the comments

[@nonkelsue]

@@TechTutorialsDavidMcKone Thanks David! Appreciated!

[@bcthales8673]

you missed a big part in configuration - crls or ocsp setup. Otherwise good.

[@TechTutorialsDavidMcKone]

Thanks for the feedback, it's really appreciated It's a while since I made this video but I think I tried to explain that I deliberately ignored those options The reason why is they'd fallen out of favour with web browser manufacturers Google for instance seemed to have switched over to some other mechanism where they provide the web browser with revoked certificate information rather than the web browser checking with the revocation server and that won't work for a private CA I noticed a setting in Firefox for oscp mind, but with less than 4% of the market share it didn't seem worthwhile even using that

[@He-Is-One-and-Only]

Thank you and i am sorry its not even 17 minutes i am at deep sleep 😴😴😴 Could have just made the video 30 minutes Max. There's too much talking alot beating around bush using vector graphics. Sorry bro i don't like it tbh

[@TechTutorialsDavidMcKone]

I appreciate the feedback This was one of my earlier videos when the channel was just getting started Since then I've been taking on advice from folks like yourself to get better But again, thanks for taking the time to leave a comment

[@soniablanche5672]

On Windows, chromium based browsers (Chrome, Brave, Edge, etc.) will recognize CA that are in the Trusted Root CA store, for firefox you will have to set security.enterprise_roots.enabled to true for firefox to recognize CA in the Trusted Root CA store

[@TechTutorialsDavidMcKone]

Thanks for the feedback, really appreciated Which version of Windows are you using? I double checked on a computer running Windows 10 Pro 21H2 and I just imported the certificate for Firefox as a trusted root CA Hit Ctrl-F5 and it now accepts the certificate I checked the settings and security.enterprise_roots.enabled was set to true The setting is also locked

[@soniablanche5672]

@@TechTutorialsDavidMcKone I'm also on Windows 10