I'd like to set up my own Certificate Authority to sign things that are only used internally.

Does anyone have any steps they've used to set up their own CA and begin signing certs. I'd also like to produce a chain cert.

From there, I'll have used import these as trusted CA's into their OS's and/or browsers.

I want to use openssl for this and not AD.


If you want a basic CA, then I suggest setting up tinyca. On my system I basically setup Ubuntu on a USB flash disk, so I could have my CA be offline. Then I installed tinyca via apt.

Once you have your environment ready, just use the GUI to create certs as needed.

  • +1 for keeping the CA offline. Great idea. I could see running it only in non-network-connected environments and burning certificates and CA backups only to virgin WORM media (e.g. CD-R) in order to protect it from the risk of external compromise. One could even keep the entire CA locked up in a safe. Neat. – Skyhawk Jan 18 '12 at 0:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.