I have an SSL certificate from sslforfree. I have the ca-bundle, certificate and its private key.

I'd like to create my own certificate, for different subdomains. My hope is that somehow, I can sign that certificate with my existing certificates in a way, that it'll pass all those ssl checks that browsers and mail clients, and others do.

I followed through dozens of tutorials, but either I'm missing an important nuance, or those tutorials are not what I want.

Can anybody help me, how can I sign my new certificates with openssl from CentOS 7?


Technically, you can do that, but no one will trust these certificates. Your SSL certificate is *NOT ALLOWED* to sign other certificates.

If you look at your certificate you may find a Basic Constraints certificate extension that tells about the subject type: end entity or CA. isCA bit will be set to 0, implying that the holder of the certificate is end entity. Certificate validation code will strictly check this field and if they find that end entity certificate was used to sign other certificates, they will be automatically rejected. For reference: RFC 5280 §

  • I have 2 crt files, as I said. One of which I have the private key for, which is not a CA certificate as I checked. The other is the ca-bundle.crt is a CA certificate, but I don't have the private key for it. Is it still impossible to sign my certificateM Jul 11 '19 at 19:51
  • CRT files won't help you, because they contain only public certificates, while signing requires a possession of private key for a corresponding certificate. The answer is the same.
    – Crypt32
    Jul 11 '19 at 19:54

Look at your cert with a command like this openssl x509 -text -in filename. See the CA:FALSE? That is a flag that says the certificate cannot be used to as a CA, or to sign subordinate certificates.

        Version: 3 (0x2)
        Serial Number:
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
            Not Before: Jul  8 22:26:53 2019 GMT
            Not After : Oct  6 22:26:53 2019 GMT
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical

No CA from a trusted root is going to give you a cert with that enabled. If they did, you would be able to MITM anyone in the world.

I'd like to create my own certificate, for different subdomains.

Just use letsencrypt. You can get all the free certs you want for domains that you can validate either by DNS, or an HTTP challenge. You can use the official client, or third party clients. There is lots of easy to use clients for Letsencrypt.

  • I see... I wanted to create a wildcard certificate, which is impossible with sslforfree and hover. Hover is my domain name provider, which doesn't allow for 1s TTL, but sslforfree will not trust my domain, until I set that TTL. It's a shame Jul 11 '19 at 19:54
  • Then don't use 'sslforfree' use a different letsencrypt client. I have no idea why it would need a 1 second TTL, that seems silly.
    – Zoredache
    Jul 11 '19 at 19:57
  • 1
    If that's your only problem, just use a different TTL. SSLforFree is looking for 1 hour, which every DNS provider will offer. If you can't set a value of "1" then you're probably setting TTL in seconds (which would be standard compliant). Just use a value of 3600 and be done with it. Even if that isn't it, LetsEncrypt systems don't check the TTL of the DNS record, only the name/value pair.
    – Ruscal
    Jul 11 '19 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.