1
00:00:00,000 --> 00:00:10,940
In this video, you'll learn how to create self-signed certificates.

2
00:00:10,940 --> 00:00:15,000
So PKI certificates are commonly used in Linux services.

3
00:00:15,000 --> 00:00:19,299
And to secure resources like web servers, it's essential to understand how certificates

4
00:00:19,299 --> 00:00:21,080
are working.

5
00:00:21,080 --> 00:00:25,139
To use public keys, they need to be signed by a certificate authority.

6
00:00:25,139 --> 00:00:29,780
And self-signed certificates are an easy way to get started with your own certificates.

7
00:00:29,780 --> 00:00:34,939
And as just mentioned, it's perfectly acceptable to use them if you are using them internally

8
00:00:34,939 --> 00:00:36,580
only.

9
00:00:36,580 --> 00:00:41,660
And these certificates can next be used in different services that need a TLS encrypted

10
00:00:41,660 --> 00:00:44,619
channel, for instance.

11
00:00:44,619 --> 00:00:48,880
Now let me demonstrate how to do this.

12
00:00:48,880 --> 00:00:51,220
So first, I walk you through the demo.

13
00:00:51,220 --> 00:00:55,560
And you need to understand that this demo consists of different steps.

14
00:00:55,560 --> 00:00:59,740
Step number one is where you create the certificate authority.

15
00:00:59,740 --> 00:01:03,299
Well, self-signed certificates are all about certificates that are signed.

16
00:01:03,299 --> 00:01:07,519
And signing takes place by the certificate authority.

17
00:01:07,519 --> 00:01:10,480
I'll later tell you about the commands.

18
00:01:10,480 --> 00:01:14,000
Next step is to create the certificate.

19
00:01:14,000 --> 00:01:18,320
So you need to create a private key and generate a certificate request from it.

20
00:01:18,320 --> 00:01:21,959
In case you are wondering what is this between the double quotes, well, that is how you can

21
00:01:21,959 --> 00:01:28,739
easily recognize the required commands in the man pages I will show you in a bit.

22
00:01:28,739 --> 00:01:32,739
So the certificate is extracted from a private key.

23
00:01:32,739 --> 00:01:38,779
And once you have extracted the certificate signing request from the private key, you

24
00:01:38,779 --> 00:01:41,320
can self-sign the certificate.

25
00:01:41,320 --> 00:01:46,519
So when you generate a public-private key pair, you create certificate signing requests.

26
00:01:46,519 --> 00:01:49,419
And that is what you send to the certificate authority.

27
00:01:49,419 --> 00:01:52,620
And that is going to do the signing for you.

28
00:01:52,620 --> 00:01:54,580
And that is how it works.

29
00:01:54,580 --> 00:01:58,260
Let me show you so that we can see the result.

30
00:01:58,260 --> 00:02:02,459
So I'm going to create these certificates in a dedicated directory.

31
00:02:02,459 --> 00:02:05,500
So mkdir openSSL.

32
00:02:05,500 --> 00:02:07,300
It's in my home directory, and that's okay.

33
00:02:07,300 --> 00:02:10,660
I just want to save location where I can work with this.

34
00:02:10,660 --> 00:02:13,860
Then I'm going to use the openSSL command.

35
00:02:13,860 --> 00:02:18,660
There are some easy-to-use front-end commands, but the easy-to-use front-end commands all

36
00:02:18,660 --> 00:02:20,539
go back to openSSL.

37
00:02:20,539 --> 00:02:24,220
They're distribution-specific, which is why I don't like them.

38
00:02:24,220 --> 00:02:28,539
Never invest your time in understanding openSSL.

39
00:02:28,539 --> 00:02:33,220
Gen rsa to generate an rsa key.

40
00:02:33,220 --> 00:02:40,220
Minus dash 3, which is the encryption algorithm, and minus out is specifying the output.

41
00:02:40,220 --> 00:02:43,220
And the output is myca.key.

42
00:02:43,220 --> 00:02:50,979
2048 is the number of bits that I'm using for this key.

43
00:02:50,979 --> 00:02:55,660
So what you generate here is a private key, and the encryption algorithm makes it you

44
00:02:55,660 --> 00:02:59,820
can use it as a certificate authority private key.

45
00:02:59,820 --> 00:03:05,339
Now you need passphrase, and this passphrase is what you are going to use whenever you

46
00:03:05,339 --> 00:03:07,940
need to use the private key.

47
00:03:07,940 --> 00:03:14,419
So the certificate authority private key is used for signing of public key certificates,

48
00:03:14,419 --> 00:03:18,300
and you should protect that because this is secure business.

49
00:03:18,300 --> 00:03:22,940
And that is why, in this case, I'm entering a passphrase.

50
00:03:22,940 --> 00:03:26,619
Now I'm using openSSL reg for a request.

51
00:03:26,619 --> 00:03:27,619
Minus x509.

52
00:03:27,619 --> 00:03:30,699
That's the x509 certificate.

53
00:03:30,699 --> 00:03:31,699
Minus new.

54
00:03:31,699 --> 00:03:32,699
We want a new one.

55
00:03:32,699 --> 00:03:33,699
No dash.

56
00:03:33,699 --> 00:03:35,100
We don't need dash encryption.

57
00:03:35,100 --> 00:03:38,820
Minus key, myca.key.

58
00:03:38,820 --> 00:03:42,820
Minus sha256 for the algorithm.

59
00:03:42,820 --> 00:03:46,860
Minus dash 3650.

60
00:03:46,860 --> 00:03:48,179
That's the validity.

61
00:03:49,059 --> 00:03:52,779
And minus out myca.pen.

62
00:03:52,779 --> 00:03:53,779
So what is this doing?

63
00:03:53,779 --> 00:04:00,020
Well, this is going to create the certificate authority certificate, and that is what you

64
00:04:00,020 --> 00:04:02,580
are going to hand out to the clients.

65
00:04:02,580 --> 00:04:07,259
An important parameter is minus dash 3650.

66
00:04:07,259 --> 00:04:13,779
The certificate authority certificate typically is valid for a long period because if it expires,

67
00:04:13,779 --> 00:04:19,100
all the certificates that it has signed will expire as well.

68
00:04:19,100 --> 00:04:20,739
Now we need to enter the passphrase.

69
00:04:20,739 --> 00:04:24,339
That's the passphrase for the certificate authority private key.

70
00:04:24,339 --> 00:04:27,579
And now it is asking me more information about it.

71
00:04:27,579 --> 00:04:35,019
Now for the CA, it's not essential, but it's good practice to include the information.

72
00:04:35,019 --> 00:04:41,500
But if it's internal only, feel free to enter on all requests because these parts of information

73
00:04:41,500 --> 00:04:43,980
are used for verification purposes.

74
00:04:43,980 --> 00:04:45,859
It's relevant on the internet.

75
00:04:45,859 --> 00:04:50,739
For a self-signed certificate, it's not that relevant.

76
00:04:50,739 --> 00:04:56,260
Now I'm going to create a private key and generate a certificate request from it.

77
00:04:56,260 --> 00:05:01,260
So at this point, we have the myca.key and the myca.pen, which means that we have the

78
00:05:01,260 --> 00:05:03,980
certificate authority key material.

79
00:05:03,980 --> 00:05:08,179
So now let's create a private key for use in a server.

80
00:05:08,179 --> 00:05:17,940
OpenSSL genRSA minus out TLS.key 2048.

81
00:05:17,940 --> 00:05:21,420
So once again, we generate a private key.

82
00:05:21,420 --> 00:05:28,019
And the only difference with the private key used by the CA is that we don't use DES3 algorithm,

83
00:05:28,019 --> 00:05:30,459
but it's still a private key.

84
00:05:30,459 --> 00:05:36,339
From the private key, we are going to extract the certificate signing request.

85
00:05:36,339 --> 00:05:39,779
So openSSL reg for request minus new.

86
00:05:39,779 --> 00:05:47,100
So new request minus key TLS.key minus out TLS.csr.

87
00:05:47,100 --> 00:05:49,899
That is the certificate signing request.

88
00:05:49,899 --> 00:05:52,980
And that is what you are going to sign later.

89
00:05:52,980 --> 00:06:00,500
Now while creating the certificate signing request, you need at least to enter a common name.

90
00:06:00,500 --> 00:06:05,700
The country name, the state, the locality, that doesn't matter too much.

91
00:06:05,700 --> 00:06:11,140
What matters is the common name, because the common name is the name of your server host.

92
00:06:11,140 --> 00:06:15,859
So let's call it linuxplus.example.com.

93
00:06:15,859 --> 00:06:21,299
Think about this carefully, because this certificate is going to be used by the server.

94
00:06:21,299 --> 00:06:27,739
And if the certificate name does not match the name of the user, then the client will reject it.

95
00:06:27,739 --> 00:06:30,820
So this is very important information.

96
00:06:30,820 --> 00:06:33,459
The rest of the information is all optional.

97
00:06:33,459 --> 00:06:39,179
So now we have the certificate signing request, and we can go over to step three.

98
00:06:39,179 --> 00:06:47,779
And step three is where we are going to use the certificate authority to sign the certificate request.

99
00:06:47,779 --> 00:06:55,579
And that is openSSL x509 minus reg minus in TLS.csr.

100
00:06:55,579 --> 00:06:59,660
So we put the certificate signing request in minus ca.

101
00:06:59,660 --> 00:07:02,739
That's an identifier of the certificate authority.

102
00:07:02,739 --> 00:07:08,859
And this certificate authority is just identified by its public key certificate.

103
00:07:08,859 --> 00:07:13,619
But we also need access to the ca private key.

104
00:07:13,619 --> 00:07:18,660
Now the ca needs to create a serial number for its own administration.

105
00:07:18,660 --> 00:07:22,980
And minus out is specifying what it is going to create.

106
00:07:22,980 --> 00:07:25,859
So it creates TLS.crt.

107
00:07:25,859 --> 00:07:28,100
Minus days, 1650.

108
00:07:28,100 --> 00:07:30,619
That's the validity of the request.

109
00:07:30,619 --> 00:07:36,459
And you need to make sure that it will be valid throughout the lifetime of the certificate authority,

110
00:07:36,459 --> 00:07:38,619
the public key certificate.

111
00:07:38,619 --> 00:07:43,899
And finally, minus sha256 for the encryption algorithm.

112
00:07:43,899 --> 00:07:45,380
Oh, and did I make a mistake?

113
00:07:45,380 --> 00:07:47,019
Yeah, I made a mistake.

114
00:07:47,019 --> 00:07:51,019
My mistake is in the ca minus ca key.

115
00:07:51,019 --> 00:07:56,820
Minus ca key needs the argument myca.key.

116
00:07:56,820 --> 00:07:59,739
And now we can see that it is doing all right.

117
00:07:59,739 --> 00:08:03,459
We can see the common name, and it's asking for the passphrase.

118
00:08:03,459 --> 00:08:08,299
That is the certificate authority passphrase that I've used before.

119
00:08:08,299 --> 00:08:09,899
So I'm going to enter it.

120
00:08:09,899 --> 00:08:13,940
And the result is that now I have a TLS.crt.

121
00:08:13,940 --> 00:08:19,059
That is the public key certificate that will be handed out to the clients.

122
00:08:19,059 --> 00:08:25,899
And the TLS.key, that is the private key that I can use on my server itself.

123
00:08:25,899 --> 00:08:29,739
Now, the procedure that we have just gone through is a complex procedure.

124
00:08:29,739 --> 00:08:31,500
So I want you to understand what to do.

125
00:08:31,500 --> 00:08:36,940
So I've created some slides with all the commands where I'm going to tell you what it is doing.

126
00:08:36,940 --> 00:08:40,340
So first, we were using OpenSSL GenRSA.

127
00:08:40,340 --> 00:08:45,580
GenRSA is a generic part that generates the private key.

128
00:08:45,580 --> 00:08:51,659
DES3 is the encryption algorithm, which is recommended for the certificate authority

129
00:08:51,659 --> 00:08:53,580
because it's relatively strong.

130
00:08:53,580 --> 00:08:56,419
And OUT generates an output file.

131
00:08:56,419 --> 00:09:00,979
Next step was OpenSSL REC-X509.

132
00:09:00,979 --> 00:09:08,979
So the REC argument calls the PKCS10 certificate request and certificate generating utility.

133
00:09:08,979 --> 00:09:13,539
So OpenSSL always works with specific subcommands.

134
00:09:13,539 --> 00:09:16,099
And REC is what we are using here.

135
00:09:16,099 --> 00:09:20,780
X509 produces a self-signed certificate instead of a CSR,

136
00:09:20,780 --> 00:09:23,260
which is a certificate signing request.

137
00:09:23,260 --> 00:09:25,500
NEW generates a new request.

138
00:09:25,500 --> 00:09:30,979
NODES ensures that if a private key is created, it is not encrypted.

139
00:09:30,979 --> 00:09:34,099
KEY specifies the file to read the key from.

140
00:09:34,099 --> 00:09:38,059
SHA-256 is used to generate secured hashes.

141
00:09:38,059 --> 00:09:42,580
And DASE specifies the validity of the certificate in DASE.

142
00:09:42,580 --> 00:09:45,260
And .PAM is a self-signed PAM file,

143
00:09:45,260 --> 00:09:48,659
a file that can be used to distribute a complete certificate chain,

144
00:09:48,659 --> 00:09:52,539
and which is a common standard in cryptography.

145
00:09:52,539 --> 00:09:57,780
Now, notice that the example generate a self-signed root certificate also works.

146
00:09:57,780 --> 00:10:00,739
Have a look at MAN OpenSSL-REC.

147
00:10:00,739 --> 00:10:05,099
And this combines this step with the previous step.

148
00:10:05,099 --> 00:10:11,020
Next, we have used the OpenSSL GenRSA-OUTTLS.key,

149
00:10:11,020 --> 00:10:15,500
which will generate a private key to be used by your server.

150
00:10:15,500 --> 00:10:20,940
From that private key, we have extracted the certificate signing request.

151
00:10:20,940 --> 00:10:24,619
And minus OUTT is the name of the certificate signing request.

152
00:10:24,619 --> 00:10:27,059
And very important is the common name.

153
00:10:27,059 --> 00:10:31,260
It needs to match the host name that is going to use the certificate.

154
00:10:31,260 --> 00:10:33,780
And you can find these commands in the MAN page as well.

155
00:10:33,780 --> 00:10:36,419
If you use MAN OpenSSL-REC,

156
00:10:36,419 --> 00:10:40,820
look at create a private key and generate a certificate request from it.

157
00:10:40,820 --> 00:10:42,859
You don't have to memorize all of this.

158
00:10:42,859 --> 00:10:49,979
If you have system access, the MAN page of OpenSSL-REC is quite specific.

159
00:10:49,979 --> 00:10:55,619
Last step was OpenSSL-X509, where X509 is assigning utility.

160
00:10:55,619 --> 00:10:59,260
REC tells OpenSSL that we need to create a request.

161
00:10:59,260 --> 00:11:00,780
IN is for the input file.

162
00:11:00,780 --> 00:11:06,460
CA and CA-KEY are identifying the certificate authority keys.

163
00:11:06,460 --> 00:11:12,580
CA-CREATE-SERIAL is a mandatory option that will create the CA serial number.

164
00:11:12,580 --> 00:11:15,460
OUT is a certificate that is going to be produced.

165
00:11:15,460 --> 00:11:17,020
DASE is the validity.

166
00:11:17,020 --> 00:11:21,260
And SHA-256 is the hashing algorithm.

167
00:11:21,260 --> 00:11:26,619
And you can also find this information in MAN OpenSSL-X509

168
00:11:26,619 --> 00:11:32,299
in signer certificate request using the certificate extensions.

169
00:11:32,299 --> 00:11:37,979
And that is how you can create your own self-assigned public-private certificate pair.

170
00:11:37,979 --> 00:11:41,299
And you can use them internally on your web servers, for instance.