Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to set up my own Certificate Authority to sign things that are only used internally.

Does anyone have any steps they've used to set up their own CA and begin signing certs. I'd also like to produce a chain cert.

From there, I'll have used import these as trusted CA's into their OS's and/or browsers.

I want to use openssl for this and not AD.

share|improve this question
up vote 4 down vote accepted

If you want a basic CA, then I suggest setting up tinyca. On my system I basically setup Ubuntu on a USB flash disk, so I could have my CA be offline. Then I installed tinyca via apt.

Once you have your environment ready, just use the GUI to create certs as needed.

share|improve this answer
+1 for keeping the CA offline. Great idea. I could see running it only in non-network-connected environments and burning certificates and CA backups only to virgin WORM media (e.g. CD-R) in order to protect it from the risk of external compromise. One could even keep the entire CA locked up in a safe. Neat. – Skyhawk Jan 18 '12 at 0:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.