WARNING: This information is a bit outdated...

Create the CA private/public key-pair

It's now time to create the CA key-pair. I use a 8192 bits RSA key-pair, and I ask OpenSSL to encrypt the private key with Triple-DES, using a passphrase as the Triple-DES key:

Generate the CA certificate

Now that we have the private/public key-pair, let's go ahead and generate the self-signed certificate:


Note that older versions of openssl doesn't support the subject option, -subj, so leave it out and let OpenSSL prompt you for the individual fields. See the OpenSSL manpage 'req' for a description about the subject fields. Also you might want to add some fields, like Org. Unit (OU) or email address (emailAddress).

[Optional] Convert the CA certificate from PEM to DER format

The certificate generated above (/opt/CA/certs/<MyDomain>-ca.crt) is in PEM format, which is good for applications (servers), OpenSSL clients, Netscape and Mozilla browsers, and newer versions of Internet Explorer. For older versions of Internet Explorer you should convert the certificate to DER format, which we can do like this:

Note that older versions of openssl, seem to have a problem converting just a certificate, as opposed to a public or a private key.

Tell everyone about your CA certificate

In order to use SSL certificates that you sign with you CA certificate seamless, you need to tell your SSL clients about your new fance CA certificate.

Store your CA certificate on a web server

In order to facilitate propagation, I keep my PEM encoded CA certificate on my web server (right here: ca.crt). Just make sure your web server have associated .crt extensions with the application/x-x509-ca-cert mime type.

Browsers

Click on your certificate link on your web page, or copy the certificate to the system that has the browser on it, and open the certificate in your browser as a file, using the file:// method.

For netscape browsers, I enable all three forms of certificate use (website, email users, software signing).

For Internet Explorer, after you click on the CA certificate, it asks you what you want to do. Click on "Open", click on "Install Certificate...", click on "Next>", select "Place all certificates in the following store", browse and select "Trusted Root Certification Authorities", click "Ok", click "Next>", click "Finish", click "Yes", and you are done.

OpenSSL clients

For OpenSSL clients, such as pine under unix, you need to install your CA certificate in the client system's OpenSSL certificate directory. This is usually /usr/share/ssl/certs on systems that bundle OpenSSL (Linux), otherwise it's typically /usr/local/ssl/certs or /usr/local/share/ssl/certs.

First, copy your CA certificate (<MyDomain>-ca.crt) into the OpenSSL .../ssl/cert directory.

Then, figure out the OpenSSL hash value for the subject in your CA certificate:

The hash value is an 8-digit hexadecimal number. You need to create a symbolic link in the OpenSSL .../ssl/certs directory using the hash value as it's name with ".0" appended to the end of the hash value. This symbolic link has to point to the CA certificate file. You can do this in one operation like this:

Generating an Apache web server SSL certificate

On the CA system again, create a new 1024 bits RSA public/private key-pair for your web server:


Then generate the certificate request using this key pair:


Note that the commonName field (CN) has to be the virtual hostname of the web server that you are going to use this SSL certificate with.

Note that older versions of openssl doesn't support the subject option, -subj, so leave it out and let OpenSSL prompt you for the individual fields. See the OpenSSL manpage 'req' for a description about the subject fields.

And finally, take the certificate request and sign it using your CA private key. The result is your new web server SSL certificate:


In order to use this SSL certificate with your apache web server, you need to copy the web server private key, the web server SSL certificate, and the CA certificate to your apache installation directory, on your web server:


Edit the apache conf/ssl.conf file, and change:


and restart apache.

Generating a mail server certificate

This certificate will work both with UW's imapd and postfix.

The steps to create a key-pair, generate the certificate request, and signing it with the CA private key for imapd/postfix is identical to how we did it for apache above.

So in rapid sequence, we do:

Note that older versions of openssl doesn't support the subject option, -subj, so leave it out and let OpenSSL prompt you for the individual fields. See the OpenSSL manpage 'req' for a description about the subject fields.

Imapd/postfix needs the private key and the certificate to be in the same file, so we can just concatenate both of them like this:


For UW's imapd, copy the joint private key and certificate PEM encoded file to your mailserver in the OpenSSL .../ssl/certs directory, and call it "imapd.pem".

Postfix

For postfix, copy the joint private key and certificate PEM encoded file to your mailserver in /etc/postfix, and call it "smtp.pem".

And at a minimum, add the following configuration directives in /etc/postfix/main.cf:



Also enable the postfix smtps daemon program in /etc/postfix/master.cf, and make sure you define the smtps service in /etc/services (465/tcp).

In addition, once SSL is working, if you want to turn on SMTP authentication (using SASL), and disable cleartext passwords unless SSL is used, add the following to main.cf:


Note that we just added the 'permit_sasl_authenticated' to 'smtpd_recipient_restrictions', the other two options are present by default.