Certificate generation with OpenSSL

AN4683

28/31

DocID027745 Rev 1

Appendix A

Certificate generation with OpenSSL

OpenSSL is an open-source implementation for PC platforms (Win, *nix, Mac) of the

SSL/TLS protocols providing both client and server functionalities. The core library, written

in the C programming language, implements the basic cryptographic functions and provides

various utility functions. For testing purposes, OpenSSL-1.0.1i has been used as TLS

Server. For documentation and installation instructions, please refer to OpenSSL website

(see [12] in References).

Just for example purposes, included below are the OpenSSL commands to generate RSA

and EC compatible certificates and associated private keys.

Example for generating RSA signed certificates:

Generate key pair and a self-signed certificate for the CA (trusted certificate):

1.

openssl genpkey -out ca_key.pem -outform PEM -algorithm rsa -pkeyopt

rsa_keygen_bits:1024

2.

openssl req -new -key ca_key.pem -days 6500 -set_serial 1111 -subj

“/C=IT/ST=Lombardia/L=Milan/O=STM/OU=R&D/CN=CA domain” -out ca_cert.pem -

x509

Generate server certificate/key pair:

3.

openssl genpkey -out server_key.pem -outform PEM -algorithm rsa -pkeyopt

rsa_keygen_bits:1024

4.

openssl req -new -key server_key.pem -days 6500 -set_serial 2222 -subj

“/C=IT/ST=Lombardia/L=Milan/O=STM/OU=R&D/CN=server domain” -out

server_cert_req.pem

5.

openssl ca -in server_cert_req.pem -out server_cert.pem -days 6500 -keyfile

ca_key.pem -cert ca_cert.pem -notext -batch

Generate client certificate/key pair:

6.

openssl genpkey -out client_key.pem -outform PEM -algorithm rsa -pkeyopt

rsa_keygen_bits:1024

7.

openssl req -new -key client_key.pem -days 6500 -set_serial 3333 -subj

“/C=IT/ST=Lombardia/L=Milan/O=STM/OU=R&D/CN=client domain” -out

client_cert_req.pem

8.

openssl ca -in client_cert_req.pem -out client_cert.pem -days 6500 -keyfile

ca_key.pem -cert ca_cert.pem -notext -batch

Example for generating ECC signed certificates:

Generate key pair and a self-signed certificate for the CA (trusted certificate):

1.

openssl ecparam -out ca_key.pem -name prime192v1 -genkey

2.

openssl req -new -key ca_key.pem -days 6500 -set_serial 1111 -subj

“/C=IT/ST=Lombardia/L=Milan/O=STM/OU=R&D/CN=CA domain” -out ca_cert.pem -

x509