I want to create a different (unique), self signed, certificate to distribute to some clients. That way I think that if one is doomed, I just have to delete his certificate without bothering the others

I followed this nice article : http://www.eclectica.ca/howto/ssl-cert-howto.php

Now, it seems that I am obliged to create a root certificate every time I want to generate a unique certificate for a different client.

Am I really obliged to create a unique root CA + sign a certified certificate every time ?

Isn't there an easier way ? (like avoiding to recreate the root ca every time ?)


You should probably do some reading-up on how a PKI is typically deployed for some background.

The document you linked goes through creating your own root Certification Authority (CA). Once you've done that, you will use that CA to sign and enroll certificates for individual devices (or, to sign a certificate for an intermediary CA-- probably beyond the scope of your needs).

You do not want a proliferation of CA roots. You would typically create one root, and use it to sign certificates for devices.

The general workflow, after you've deployed your CA root, is:

  • Create public/private key pair on host that needs certificate
  • Create certificate signing request (CSR) on host that needs a certificate
  • Submit the CSR to the CA root for signing
  • Take the certificate that the CA root returns and install it on the device or host

That document you linked describes Creating a Certificate Signing Request, but it really doesn't describe that this is a process you'd typically do from the device / host requesting the certificate.

You can create public/private key pairs and CSRs off the device/host, but arguably the most secure way to do it is on the device/host itself because the private key never leaves the device.

From an OpenSSL client, for example, here's how I'd prepare a certificate signing request (CSR) for a 4096-bit RSA key:

  • openssl req -out Signing_Request.csr -new -newkey rsa:4096 -nodes -keyout private.key

On an IIS web server I'd use the built-in GUI "Wizard" to prepare a new CSR. Other software will have different methods of preparing the CSR.

Once I have the CSR I'll ship it over to the CA and, as that document you linked to describes in the Signing a Certificate section, I'd have the CA sign the request and install the resulting certificate onto the requesting device/host.

As an aside: You will typically distribute your CA certificate throughout your enterprise so that clients can verify the signatures your CA is putting on certificates and to prevent warnings about the certificates coming from an untrusted CA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.