Step 2.1 - Generate the Server Certificate Private Key This step may be repeated for each server you need. server FQDN or YOUR name) :Įmail Address CA will be created once you enter your information. Organizational Unit Name (eg, section) :SecurityĬommon Name (e.g. Organization Name (eg, company) :Devolutions inc. If you enter '.', the field will be left blank.īelow is an example using information that is specific to Devolutions (replace with your own specific information): Country Name (2 letter code) :CA There are quite a few fields but you can leave some blankįor some fields there will be a default value, What you are about to enter is what is called a Distinguished Name or a DN. Here is what the request looks like: You are about to be asked to enter information that will be incorporated You will be prompted to provide some information about the CA. Generate the Root CA certificate using the following command line: openssl req -new -x509 -sha256 -key ca.key -out ca.crt Here is a link to additional resources if you wish to learn more about this. The CA generates and issues certificates. Step 1.2 - Generate the Certificate Authority Certificate We know that Curve25519 is considered safer than this NIST P-256 curve but it is only standardized in TLS 1.3 which is not yet widely supported. This will create a 256-bit private key over an elliptic curve, which is the industry standard. Generate this using the following command line: openssl ecparam -name prime256v1 -genkey -noout -out ca.key Ok, ready? Let’s get started! Step 1 - Certificate Authority Step 1.1 - Generate the Certificate Authority (CA) Private KeyĮvery certificate must have a corresponding private key. There is one requirement before starting all of this, you’ll need to have OpenSSL. This way, everything should be clear, and my hope is that you won’t waste time or get frustrated along the way. My goal is to make this as simple as possible for you, and so I have broken every action down into a single step. While there are many steps in this process, please do not worry. I choose to use OpenSSL because it is available on all platforms (Linux, macOS, Windows) which means this tutorial can be followed on any platforms. And so, since “necessity is the mother of invention”, I decided to create a simple tutorial and share it with all of you! Why OpenSSL?

However, I have found that many tutorials available on the web are complicated, and they do not cover certificates that use safe algorithms. For testing purposes, it is necessary to generate secure self-signed server and client certificates.

Openssl test tls 1.2 with cert