Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is the situation: I have a secure server but I only want to provide access to those having certain certificate files. I've already setup apache (see How to provide HTTPS access to a webserver that doesn't support SSL?). I want to know how to create different certificates that will validate against my own CA.

Further, can I import those certificate files in a browser like Firefox/Chromium?

(I want all this using openssl of course)

EDIT: Part of the httpd.conf


# require a client certificate which has to be directly
# signed by our CA certificate in ca.crt
SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile conf/ssl.crt/ca.crt
share|improve this question
Do you already have a CA? Or as you asking for suggestions on the software needed to run one? Are you end-users technical enough to build a CSR and forward it to you, or do you need web-based portal where they can request certificates themselves. – Zoredache Aug 8 '11 at 18:29
If you are looking for CA software, maybe look at either TinyCA, or EJBCA. – Zoredache Aug 8 '11 at 18:31
I'm not sure, I the ca.crt file from above. – Tomas Aug 8 '11 at 18:35
Did you create that certificate? Where did it come from? Are there any existing certificates that have been issued against that CA? If not, consider installing TinyCA or something and building a New CA. – Zoredache Aug 8 '11 at 18:41
I did create that certificate. It came from the standard openssl.cnf. There are not certificates issued against that CA, and that's what I actually want to do. – Tomas Aug 8 '11 at 18:47

If I understand the question correctly you want the easy-rsa stuff thats included with most openssl distributions. You basically need to build the CA part (looks like you did that already, but you may want to redo it per these docs), then create client certs and sign them with the CA cert (the included scripts take care of all this). You can get more information here:

Or find the easy-rsa directory for your openssl installation, it should look like this:

# cd /usr/share/doc/openvpn-2.0.9/easy-rsa/;ls
2.0       build-dh     build-key       build-key-pkcs12  build-req       clean-all  make-crl     README      revoke-full  vars
build-ca  build-inter  build-key-pass  build-key-server  build-req-pass  list-crl   openssl.cnf  revoke-crt  sign-req     Windows

Run through the instructions in the README, then use ./build-key to create your client certificates. As you mentioned you will need to install the ca.crt on your clients. I believe Chrome will use the system openssl if you want, I think firefox has to have the cert installed into its own key-store (in my experience).

I use this alias now to build client keys so they get signed by the CA before I send the cert to the user:

build_key is a function
build_key () 
    cd /usr/share/doc/openvpn-2.0.9/easy-rsa/;
    echo "key name?";
    read answer;
    ./build-key $answer
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.