Confirmed users, Administrators
5,526
edits
SecurityEngineering/x509Certs: Difference between revisions
m
→Running your Own CA
| Line 39: | Line 39: | ||
= Running your Own CA = | = Running your Own CA = | ||
If you are going to have your own CA, we recemmend building 3 certificates: a long term root cert, a medium term intermediate cert, and a short term end-entity cert. This type of hierarchy allows for a relatively simple long term root to be distributed to clients, and some flexibility on the intermediate cert so that you can change parameters based on best practices and security research. | |||
== Generate your CA Root == | == Generate your CA Root == | ||
We assume you are the domain owner of *.example.com and *.example.net. Update the values below to match your domains. We also assume that this computer is NOT connected to the internet.<br /> | We assume you are the domain owner of *.example.com and *.example.net. Update the values below to match your domains. We also assume that this computer is NOT connected to the internet.<br /> | ||
| Line 91: | Line 91: | ||
4. Intermediate sings the csr (using SHA256) and appends the extensions described in the file <br/> | 4. Intermediate sings the csr (using SHA256) and appends the extensions described in the file <br/> | ||
:"openssl x509 -req -sha256 -days 1096 -in example.csr -CAkey intkey.pem -CA int.pem -set_serial $SOME_LARGE_INTEGER -out www.example.com.pem -extfile openssl.int.cnf" | :"openssl x509 -req -sha256 -days 1096 -in example.csr -CAkey intkey.pem -CA int.pem -set_serial $SOME_LARGE_INTEGER -out www.example.com.pem -extfile openssl.int.cnf" | ||
=Security Notes = | =Security Notes = | ||
There are several organizations that try to find recommendations regarding the security parameters for key/hash sizes given current computational power. For the end date of our root cert (2017). These are the recomendations of bit sizes (from http://www.keylength.com/ ) by: | There are several organizations that try to find recommendations regarding the security parameters for key/hash sizes given current computational power. For the end date of our root cert (2017). These are the recomendations of bit sizes (from http://www.keylength.com/ ) by: | ||