Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

we have a wildcard certificate (*.ourcompany.com) purchased form digicert. I have been asked to set up a system wherein certain employee's have their own SSL Cert, to be used for signing PDF's, etc.

I have the impression that I can create these and sign them using our certificate, making them valid. however all my searching is finding me "code signing certificates" which is not at all what we are looking to do. I believe we need to make a certificate signing request somehow, with the individuals details, then sign that request, however I am unsure exactly how to do so (especially given all the different files that make up the cert we were given).

Here's what I have received:

|digicert/
|-star_ourcompany_com.csr
|-star_ourcompany_com.key
|-certs/
|--DigiCertCA2.crt
|--star_ourcompany_com.crt
|--TrustedRoot.crt

Can anyone shed any light on the best way to do this?

share|improve this question
add comment

migrated from stackoverflow.com Jul 24 '12 at 2:06

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 6 down vote accepted

You can only sign certificates with that certificate if it has the certificate-signing bit set, which it almost certainly doesn't. You need to set up your own CA with its own root. There are many tools available to help you do that. You can even do it with OpenSSL, if you can remember the dozens of commands and their dozens of sub-commands each.

share|improve this answer
    
is there a way to check if the certificate has the certificate signing bit set? I only ask because my boss is fairly trig, and I doubt he'd tell me to do something we cannot do. –  Chris O'Kelly Jul 23 '12 at 3:03
    
List all the certificate attributes with one of the thousands of OpenSSL commands, probably the x509 command. –  EJP Jul 23 '12 at 3:26
    
OK so I did sudo openssl x509 -text -in certs/star_ourcompany_com.crt and got ` X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication ` (among some other details which didn't seem pertinent). I am guessing the certificate signing bit would have been in the key usage section somewhere. Would it be somewhere else or, as is seeming more likely to me know, does getting the above response show we cannot do this using this certificate? –  Chris O'Kelly Jul 23 '12 at 3:44
4  
@ChrisO'Kelly, the extension you should look for is "Basic Constraints". It's very unlikely that your server certificate was issued with something else than CA:false (thereby making it an intermediate CA certificate). –  Bruno Jul 23 '12 at 8:04
    
Yeah EJP and Bruno, you were both right, I was on a wild goose chase. Thanks –  Chris O'Kelly Jul 23 '12 at 22:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.