0

I have an SSL certificate from sslforfree. I have the ca-bundle, certificate and its private key.

I'd like to create my own certificate, for different subdomains. My hope is that somehow, I can sign that certificate with my existing certificates in a way, that it'll pass all those ssl checks that browsers and mail clients, and others do.

I followed through dozens of tutorials, but either I'm missing an important nuance, or those tutorials are not what I want.

Can anybody help me, how can I sign my new certificates with openssl from CentOS 7?

3

Technically, you can do that, but no one will trust these certificates. Your SSL certificate is *NOT ALLOWED* to sign other certificates.

If you look at your certificate you may find a Basic Constraints certificate extension that tells about the subject type: end entity or CA. isCA bit will be set to 0, implying that the holder of the certificate is end entity. Certificate validation code will strictly check this field and if they find that end entity certificate was used to sign other certificates, they will be automatically rejected. For reference: RFC 5280 §4.2.1.9

  • I have 2 crt files, as I said. One of which I have the private key for, which is not a CA certificate as I checked. The other is the ca-bundle.crt is a CA certificate, but I don't have the private key for it. Is it still impossible to sign my certificateM – László Stahorszki Jul 11 at 19:51
  • CRT files won't help you, because they contain only public certificates, while signing requires a possession of private key for a corresponding certificate. The answer is the same. – Crypt32 Jul 11 at 19:54
2

Look at your cert with a command like this openssl x509 -text -in filename. See the CA:FALSE? That is a flag that says the certificate cannot be used to as a CA, or to sign subordinate certificates.

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ...
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
        Validity
            Not Before: Jul  8 22:26:53 2019 GMT
            Not After : Oct  6 22:26:53 2019 GMT
        ...
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE

No CA from a trusted root is going to give you a cert with that enabled. If they did, you would be able to MITM anyone in the world.

I'd like to create my own certificate, for different subdomains.

Just use letsencrypt. You can get all the free certs you want for domains that you can validate either by DNS, or an HTTP challenge. You can use the official client, or third party clients. There is lots of easy to use clients for Letsencrypt.

  • I see... I wanted to create a wildcard certificate, which is impossible with sslforfree and hover. Hover is my domain name provider, which doesn't allow for 1s TTL, but sslforfree will not trust my domain, until I set that TTL. It's a shame – László Stahorszki Jul 11 at 19:54
  • Then don't use 'sslforfree' use a different letsencrypt client. I have no idea why it would need a 1 second TTL, that seems silly. – Zoredache Jul 11 at 19:57
  • 1
    If that's your only problem, just use a different TTL. SSLforFree is looking for 1 hour, which every DNS provider will offer. If you can't set a value of "1" then you're probably setting TTL in seconds (which would be standard compliant). Just use a value of 3600 and be done with it. Even if that isn't it, LetsEncrypt systems don't check the TTL of the DNS record, only the name/value pair. – Ruscal Jul 11 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.