OpenSSL Usage Notes

The openssl program is basically a dumping ground for all sorts of SSL related functions. What it does varies wildly based on the parameters passed in. Here is a usage summary of some of the more useful functions.

• SSL is based on RSA asymmetrical encryption (aka public key encryption)
• Two files are created; a certificate (the “cert”) and a key
• The cert is public. It contains information about the cert user (i.e. the “subject”) and the organization that “signed” the cert (i.e. the “issuer”). It also contains an encrypted hash “signature” of the cert contents.
• “Signing” a cert means that a secure hash of the cert is calculated and the secure hash is encrypted with the signing authority's (the “issuer”) secret key. This encrypted hash is then appended to the certificate.
• Check the integrity of the cert by calculating the secure hash of the cert and comparing it with the decrypted signature.
• Decrypt the signature by using the public key of the issuer.
• Cert trust is based on whether or not you trust the issuer and his ability to vouch for the “subject”

openssl command [ command_opts ] [ command_args ]

This just generates a matched pair of public and private keys using the RSA algorithm. Once generated these keys can be used for other SSL activities such as encryption certificate signing.

openssl genrsa -out my_key_name.key 2048

Both the public and private keys reside in the key file. Hold this file near and dear, especially if it isn't password protected. Extract the public key portion of this with RSA command.

openssl rsa -in my_key_name.key -outform PEM -pubout -out my_public_key_name.pem

openssl ca -new -x509 -extensions v3_ca -keyout CA-key.pem -out CA-cert.pem -days 3650 -config openssl.cnf -nodes

Here is a basic version of CSR generation

openssl req -days 3650 -nodes -new -x509 -keyout ca.key -out ca.crt -config openssl.config

Cheap SSL Security has a guide to CSR generation for Apache. They recommend:

openssl req -new -newkeys rsa:2048 -nodes -keyout baggerman.org.key -out baggerman.org.crt

This makes new RSA keys. To use an existing key use this form:

openssl req -new -key key_file_name.pem -out baggerman.org.csr

This doesn't seem to support Subject Alternative Names, though. Here is some good info on how to add SAN to openssl.conf. And here is a pretty good CSR builder that knows about SANs. Here is what needs to be added to the openssl.cnf file.

[ req ]
req_extensions          = v3_req # The extensions to add to a certificate request

[ v3_req ]
subjectAltName = @alt_names

[alt_names]
DNS.1 = www.baggerman.org
DNS.2 = baggerman.org
IP.1 = 198.89.126.181

Check the CSR with the following command:

openssl req -text -noout -in baggerman.org.csr

There is also a good CSR decoder at SSL Shopper

Use the .csr file to submit a signing request to a certificate provider like CheapSSL. Save the returned certificate into to a certificate file (.cer) Also save the intermediate certificate advisory file if necessary.

openssl ca -days 3650 -out key.crt -in key.csr -config  openssl.cnf

openssl x509 -in certificate.crt -text -noout

openssl x509 -inform der -in certificate.cer -out certificate.pem

If you get an error it probably means the certificate is already in PEM format

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout mysitename.key -out mysitename.crt

Good notes at

Setup default SSL settings outside of a virtual host. Current recommended config (from https://cipherli.st/) is:

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On

Be sure to set:

SSLCertificateKeyFile   "/etc/pki/tls/private/csr.key"
SSLCertificateFile      "/etc/pki/tls/certs/web_server_cert.cer"
SSLCertificateChainFile "/etc/pki/tls/certs/intermediate.pem"