I was wondering if anyone has any idea in how to generate a signed CA cert and key using openssl? I have found this website (http://dev.mysql.com/doc/refman/5.1/en/secure-create-certs.html) to generate the client and server certs for mysql server but the example is a self-signed certificate. I use the following command for running the server and client using openssl and the generated certs and keys:

openssl s_server -accept 6502 -cert server-cert.pem -key server-key.pem -CAfile ca-cert.pem -www

openssl s_client -connect -cert client-cert.pem -key client-key.pem -CAfile ca-cert.pem

The error output I get is "Verify return code: 18 (self signed certificate)".


  • This depends on wether you need "officially"/commercially signed certificates so that browsers don't complain of if rolling your own little CA will be sufficient.
    – Sven
    Mar 7, 2011 at 23:14
  • @SvenW, since he is talking about Mysql, I doubt the commercially signed point is relevant.
    – Zoredache
    Mar 7, 2011 at 23:17
  • @user73483, have you considered using something like TinyCA instead of trying to generate the certs by hand?
    – Zoredache
    Mar 7, 2011 at 23:18
  • I haven't consider TinyCA as I am running Windows. I have generate my own cert from cacert.org. To generate the CSR, I use the following website: lwithers.me.uk/articles/cacert.html but it gives an error "unable to verify the first certificate". I use the first link (MySQL) I posted to generate the server and client certs and keys.
    – Paul
    Mar 8, 2011 at 0:54

4 Answers 4


Create Root CA (self-signed):

Let's have a look at the options in detail:

  • x509 identifies that a certificate is required, rather than just a certificate request (see below).
  • days 30000 sets the certificate to expire in a 30000 days. You may want to extend this period. Make a note of the expiry date so that you can renew it when necessary!
  • sha1 specifies that SHA1 encryption should be used. rsa:2048 sets the key as 2048 bit RSA.
  • nodes specifies no passphrase.
  • keyout and -out specify where to store the certificate and key. The key should be root-readable only; the certificate can be world-readable, and must be readable by the user that Apache runs as.
  • subj flag sets the company name, department name, and the web site address. If you leave these out, you'll be prompted for them. The CN must be the same as the address of your web site, otherwise the certificate won't match and users will receive a warning when connecting. Make sure you don't use a challenge password.

Create it :

sudo openssl req -x509 -nodes -newkey rsa:2048 -sha1 -keyout rootkey.key -out rootca.crt -passin pass:root -days 30000 -subj "/C=DU/ST=Dubai/L=TownCenter/O=AmesCom/CN=AmesCom Int" -config openssl.cnf.my

Encrypt the key manually :

key is not encrypted because of -nodes option , so we encrypt it manually :

sudo cp rootkey.key rootkey.key.org

sudo openssl rsa -in rootkey.key.org -out rootkey.key

Test it :

for testing immediately , you may follow two ways :

openssl x509 -text -noout -in rootca.crt 

or examine its contents on browser :

cp rootca.crt /var/www/html/

from browser ask for address :


Now you can create certificate requests and sign them with this self-signed certificate

  • You can buy signed certificates from commercial providers out there.
  • You can use OpenCA
  • You can build your own Certificate Authority
  • You can use self-signed certificates as shown here: http://www.stunnel.org/?page=howto

I have resolve this a while back but here is the answer.

I managed to generate my own certs using the following website : ConfiguringApache2ForSSLTLSMutualAuthentication

I have tested on openssl between two PCs plus tested over the airwaves between Sierra Wireless modem and openssl server.

  • Welcome to Server Fault - we prefer answers that actually have content - this answer is essentially just a link with window dressing, and if the link breaks the answer becomes useless. Please consider updating your answer to contain more of the relevant details from the tutorial you linked to so that it's still useful if the link goes dead.
    – voretaq7
    Jan 25, 2013 at 16:28

I wrote a script last year to do all of it for me - creating a fake CA and signing the cert with that CA. Ensure you add the contents of ca.crt to the final PEM file if you need to have the chain intact.


Depending on it's use you'll still get CA issues with the fake signer, but it may technically work for your purpose.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.