How to create Private CA in Linux - Part 1

What is CA Certificate

A Certificate Authority (CA) is an entity responsible for issuing digital certificates to verify identities on the internet. 

Types of CA Certificate 

Public CAs

Public CAs are a popular choice for verifying the identity of websites and other services that are provided to the public.

Private CAs

Building a private Certificate Authority will enable you to configure, test, and run programs that require encrypted connections between a client and a server. With a private CA, you can issue certificates for users, servers, or individual programs and services within your infrastructure.

Create Private root-CA in Linux:

Step 1: Create folders in required path 

root@CentOS8 ~]\ [#mkdir -pv /etc/pki/CA/{certs,crl,newcerts,private}
mkdir: created directory '/etc/pki/CA'
mkdir: created directory '/etc/pki/CA/certs'
mkdir: created directory '/etc/pki/CA/crl'
mkdir: created directory '/etc/pki/CA/newcerts'
mkdir: created directory '/etc/pki/CA/private'

Step 2: Create Index serial for CA (If first created)

[root@centos8 ~]# touch /etc/pki/CA/index.txt 

# Generating Certificate Index Database
 

[root@centos8 ~]# echo 01 > /etc/pki/CA/serial 

# Specify the serial number of the first certificate issued 

Step 3: Create RSA Key for private certificate

[root@centos8 ~]# cd /etc/pki/CA/

[root@CentOS8 CA]# [#umask 066;openssl genrsa -aes256 -out private/ca-key.pem 4096]

Step 4: Generate certificate with 10 year validity

openssl req -config openssl.conf -key private/ca-key.pem -new -x509 -days 3650 -sha256 -extensions v3_ca -out certs/ca.pem
 

chmod 444 certs/ca.pem 

Step 5: Verify certificate content

openssl x509 -noout -text -in certs/ca.pem