Subject: CA Task #1: Sign a Certificate Request
Author: authen
In response to: Create Your Own Root CA (Certificate Authority)
Posted on: 03/07/2008 07:55:14 PM
Signing a certificate request means that you have yourself assured the authenticity of the certificate. To sign any message, you create its hash, and then encrypt the hash with your private key, you then add the encrypted hash and your signed certificate with the message. The recipient will recreate the message hash, decrypts the encrypted hash using your well known public key stored in your signed certificate, check that both hash are equals and finally check the certificate.
A certificate request is created by a client and brought here for your CA's trust or endorsement. The creation of client's certificate and request is out of the CA camp, but the process is briefed here for the sake of completeness.
Client: Generate a private key
C:\OpenSSL\client>openssl genrsa -des3 -out privkey.pem 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
.......................++++++
..............++++++
e is 65537 (0x10001)
Enter pass phrase for privkey.pem:<passphrase>
Verifying - Enter pass phrase for privkey.pem:<passphrase>
Client: Generate a certificate request
C:\OpenSSL\client>openssl req -new -key privkey.pem -out cert.csr
Enter pass phrase for privkey.pem:<passphrase>
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:CA
Locality Name (eg, city) []:Sunnyvale
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Test Inc
Organizational Unit Name (eg, section) []:Test Department
Common Name (eg, YOUR name) []:MyTestServer
Email Address []:MyTestServer@testinc.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:<password>
An optional company name []:MyTestProxyServer
CA: Sign a certificate requestOnce you have the certificate request 'cert.csr' from the client, you can go ahead to sign it. If this is the first request for your CA, make sure that the file 'index.txt' is empty and that the file 'serial' contains 01.
C:\OpenSSL\myCA>openssl ca -config openssl.cnf -policy policy_anything \
-keyfile cakey.pem -cert cacert.pem -out certnew.pem -days 365 -infiles cert.csr
Using configuration from openssl.conf
Loading 'screen' into random state - done
Enter pass phrase for cakey.pem:<passphrase>
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Mar 6 23:46:32 2008 GMT
Not After : Mar 6 23:46:32 2009 GMT
Subject:
countryName = US
stateOrProvinceName = CA
localityName = Sunnyvale
organizationName = Test Inc
organizationalUnitName = Test Department
commonName = MyTestServer
emailAddress = MyTestServer@testinc.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
AE:C7:10:89:AE:81:D2:1B:86:06:B1:03:E6:E0:83:D9:9C:6C:40:A6
X509v3 Authority Key Identifier:
keyid:18:DE:C7:F0:44:60:79:9D:B4:37:DC:EC:2D:74:54:9F:32:96:44:B
8
Certificate is to be certified until Mar 6 23:46:32 2009 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
This will sign the request 'cert.csr' using your CA's private key 'cacert.pem' and public certificate 'cacert.pem', and commit the certificate as 'certnew.pem'. For management purpose, your CA will automatically generate a identical copy 'xx.pem' under directory ./newcerts. Also beware that the tracking index file 'index.txt' and sequence number file 'serial' have been updated accordingly.
The file 'certnew.pem' is the response to client's request and should be sent back to your client. Here is what the file looks like:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=California, L=San Francisco, O=Open CA, OU=Open CA,
CN=My Root CA
Validity
Not Before: Mar 6 23:46:32 2008 GMT
Not After : Mar 6 23:46:32 2009 GMT
Subject: C=US, ST=CA, L=Sunnyvale, O=Test Inc, OU=Test Department,
CN=MyTestServer/emailAddress=MyTestServer@testinc.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:d7:1d:5a:2c:0e:63:c5:3c:1a:94:bf:db:84:90:
00:7f:39:17:e9:00:6f:62:15:50:8a:cd:04:a1:ad:
54:ca:fa:58:e5:d1:50:46:a8:df:4c:29:ea:22:83:
aa:10:d9:d1:c7:d7:ad:06:10:db:00:71:ac:fc:fe:
db:ee:6b:c7:94:9d:b5:6a:e6:b4:4a:ce:56:16:ca:
03:c0:99:4e:a9:4e:90:62:61:88:3b:6a:38:22:26:
7f:99:e2:c2:9f:14:94:38:02:48:e2:ec:d8:95:91:
72:3e:6a:d3:ed:e1:9c:31:58:38:e8:28:5f:5d:24:
89:38:43:13:4a:95:31:86:09
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
AE:C7:10:89:AE:81:D2:1B:86:06:B1:03:E6:E0:83:D9:9C:6C:40:A6
X509v3 Authority Key Identifier:
keyid:18:DE:C7:F0:44:60:79:9D:B4:37:DC:EC:2D:74:54:9F:32:96:44:B8
Signature Algorithm: sha1WithRSAEncryption
26:f9:b0:bf:4d:37:5b:4e:a8:74:c1:75:d5:6d:4b:f1:96:b8:
cb:4e:c6:e6:7b:0c:8a:e7:da:3d:fb:ec:2e:52:1f:09:5f:87:
64:9f:c6:d6:46:84:44:90:1a:cf:f8:13:de:6f:e3:7e:ac:00:
8e:9e:55:a2:e2:a8:7b:44:34:ab:61:e2:85:43:b8:37:77:a7:
f0:ed:97:34:79:e1:a8:70:3d:06:f9:45:19:4c:1e:ad:e2:4f:
b9:e6:8c:f9:7b:65:ff:fa:96:e8:c8:aa:26:5e:59:c8:31:74:
ea:72:a4:6d:50:e5:30:53:13:c5:2f:be:4d:48:be:27:2d:ed:
cf:ef:25:14:ee:2d:bc:e2:3a:d6:17:4b:bc:dc:f9:1a:b2:ff:
2c:17:6b:ef:e4:d1:a5:78:b7:4c:b0:9d:a8:2c:2e:c8:eb:6f:
f2:a1:d1:e7:e4:ca:5b:de:3a:4f:f0:a0:01:1b:c9:6e:82:42:
cd:80:a2:ec:10:aa:4c:48:19:fd:29:6f:9f:72:04:75:12:67:
93:be:fd:97:b0:24:06:50:ed:3e:7e:ce:a2:da:e6:be:ea:e0:
f6:62:eb:2e:e2:a5:28:a5:7f:fe:70:e8:15:58:00:02:d9:4b:
bf:c6:2a:62:08:1e:2c:64:61:30:ca:fa:4e:d9:28:22:10:eb:
4a:6c:d5:2b
-----BEGIN CERTIFICATE-----
MIIDgTCCAmmgAwIBAgIBATANBgkqhkiG9w0BAQUFADBzMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEQMA4G
A1UEChMHT3BlbiBDQTEQMA4GA1UECxMHT3BlbiBDQTETMBEGA1UEAxMKTXkgUm9v
dCBDQTAeFw0wODAzMDYyMzQ2MzJaFw0wOTAzMDYyMzQ2MzJaMIGbMQswCQYDVQQG
EwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVN1bm55dmFsZTERMA8GA1UEChMI
VGVzdCBJbmMxGDAWBgNVBAsTD1Rlc3QgRGVwYXJ0bWVudDEVMBMGA1UEAxMMTXlU
ZXN0U2VydmVyMScwJQYJKoZIhvcNAQkBFhhNeVRlc3RTZXJ2ZXJAdGVzdGluYy5j
b20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANcdWiwOY8U8GpS/24SQAH85
F+kAb2IVUIrNBKGtVMr6WOXRUEao30wp6iKDqhDZ0cfXrQYQ2wBxrPz+2+5rx5Sd
tWrmtErOVhbKA8CZTqlOkGJhiDtqOCImf5niwp8UlDgCSOLs2JWRcj5q0+3hnDFY
OOgoX10kiThDE0qVMYYJAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgEN
BB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBSuxxCJ
roHSG4YGsQPm4IPZnGxApjAfBgNVHSMEGDAWgBQY3sfwRGB5nbQ33OwtdFSfMpZE
uDANBgkqhkiG9w0BAQUFAAOCAQEAJvmwv003W06odMF11W1L8Za4y07G5nsMiufa
PfvsLlIfCV+HZJ/G1kaERJAaz/gT3m/jfqwAjp5VouKoe0Q0q2HihUO4N3en8O2X
NHnhqHA9BvlFGUwereJPueaM+Xtl//qW6MiqJl5ZyDF06nKkbVDlMFMTxS++TUi+
Jy3tz+8lFO4tvOI61hdLvNz5GrL/LBdr7+TRpXi3TLCdqCwuyOtv8qHR5+TKW946
T/CgARvJboJCzYCi7BCqTEgZ/Slvn3IEdRJnk779l7AkBlDtPn7Ootrmvurg9mLr
LuKlKKV//nDoFVgAAtlLv8YqYggeLGRhMMr6TtkoIhDrSmzVKw==
-----END CERTIFICATE-----Obviously, you can strip the extra text by just keeping the content between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- before sending it back to your client as response.
CA: Trim a certificate
C:\OpenSSL\myCA>openssl x509 -in certnew.pem -out certnew.cer
>
> On 03/07/2008 03:42:35 PM
authen wrote:
Create your CA's private key:
C:\OpenSSL\myCA>openssl genrsa -des3 -out cakey.pem 2048
Loading 'screen' into random state - done
Generating RSA private key, 2048 bit long modulus
..........+++
...................................................................+++
e is 65537 (0x10001)
Enter pass phrase for cakey.pem:<passphrase>
Verifying - Enter pass phrase for cakey.pem:<passphrase>
The private key is in 2048 bits and placed in file 'cakey.pem' which is encrypted in des3 with your input passphrase. Keep this file in a safe place like a floppy disk. Here is what the key looks like:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,53AEF89F96AEF2DC
ry0oa6dR/5S2wXnwhJUJvNzDEywbyW5M+qE59aMHiItp6zJqVVqQ/qzL/zZKkT89
KkNm9IE6mMGniJg9gcJJGgu+8rOEEP2Iptt91WrQfKPNMk4l877RXhOhOrTR3e7A
1SGINbC5fmC2QUDVWnw9WDRFxajkMmc2Q5bftFXcAoMjzFbSHdxEi5Zo44WZnD16
tx+r30dqljNmAvlXA47LERy2wjCZrXvdfVP2fEScTg1XJi+lf5FX9AfPyzXSYrfd
1/egRAJ50vy0Pf7Wz5p3TmWgXHsDgUGt23VrPlEU5y1gjw4/3e8biJWwmNMesSVC
x/tJRsb9g1m9JXrK8evFS6zlBC1kfXz5DjerCA8Q5hXyOAVJO2bN+VTiu00xaYIU
SzEOLBWCa/XA82cXFLUpNhN1lxbWzT3IByyFLJ7QXXWVcPNIPzQqxblczYOYBapS
qiao71xdAhKPbMYQwl/oTTudBf9tyxlkPWsQcrSLMRaocQzJzn+9ZOqXzIfBWAD6
ovYcjGsQZTp+jiWkxdoyOQ1JSZfw0L7NpLerRkB5UuRlpqUHvh+duhuXNXQC2rIU
BYctHT2VeGTo9G+zi4ESQsITrLCt9ts+hw0H2gmwVe96zQKzsjXf8LD4xveqaos/
XrLk5mq3Lk+LF+0psK6ySAhLrH1vYxTHNrHEPHb+/Zmz3N10+qgWSKVRGT2pcnmj
okkWS4cSyrkD/NjOOZzntEdikZ2E62UGwaA4zNLukIcRBua+6C7gIgBNT890otSn
Fhgy9ro2nvy6tUs3tGf1/xbVPiUChec9I3z4nr8yqKH2jh0JDW9mstTG0zd6HJXn
SPRvtw9vLyuveJ6oD4dnyE417JKd8z1gkhc38G4JgLUU4t+vUDpFE1sLE/4Cf7Gk
mOjF0Gtxb3ULNn80ffKrz8fC/FFaWg1/+zdZn6ox+8fe6+FvWTgLC0bajb3tSlAh
1sgr7AtuYHGZiATf1q8sDs2B5pSIqITooPNY0Kgh7e4C/+OCTURpIKIALVTMptSo
Kwhe8MRoVj+HVKIKfgi/5m0n/Y0boueGqaiuI8aFqgpZ6ijkz4WkIV8o+eWPmECS
mEsOpAQJBmOc8PShxY0mGwmrF7VpTzDotJY3thgtdlzm5zjJbLQAwBbz6oD7iSLV
7AAIR50WvO8z1b27lIYoEUakdlkpyAqOtJ8P6gy2ptL3x1nplFn2WWzEihGuJAff
Z703bnonD71oXu+U/56tMBJwr8x4MWRWXjcOwh3eyXbSV2juw3XxaNSuq3grA2iV
N35KiHRT7xiQ2CQWPVs1bZvQ7NQ8h/ZjfxJJ82eLa0vTVvFCFMUWgaowNngNK+P8
Z+73V6j6H4DWU6Y1/u2yiUdkYTzE2idkBQWzFYW1jIKLtsGxJVkmJLhF+q5ksday
7numg4NG1MorMhgDjOUFwRNk9fGt8ELQ+fGAY4pIuQVpmVGe1KPA2T3r0KNWmCxz
H5k3WTiMEDpgQcJYp53VLDlJBuL+bCh9h4yCCvxy70bR+YpYZjJP+KHsgpQHAzRH
zzwvSykM9F6UAqvnDFx4jF6Ov6mB06xWGmhDkp8sc6Ej6mfAU5NCiP3VLr7VA5Dy
-----END RSA PRIVATE KEY-----
Looks very cute, owha?
Generate your CA's certificate (public key):
Since A root CA's certificate is always a self-signed certificate, you can sign the CSR (certificate Sign Request) with the CA's private key.
C:\OpenSSL\myCA>openssl req -new -x509 -key cakey.pem \
-out cacert.pem -days 3650
Enter pass phrase for cakey.pem:<passphrase>
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Francisco
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Open CA
Organizational Unit Name (eg, section) []:Open CA
Common Name (eg, YOUR name) []:My Root CA
Email Address []:
Your root CA's certificate is valid for 3650 days and is placed in file 'cacert.pem'. The certificate looks like this (in file):
-----BEGIN CERTIFICATE-----
MIIEQjCCAyqgAwIBAgIJAPZFB8IV4uO/MA0GCSqGSIb3DQEBBQUAMHMxCzAJBgNV
BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNp
c2NvMRAwDgYDVQQKEwdPcGVuIENBMRAwDgYDVQQLEwdPcGVuIENBMRMwEQYDVQQD
EwpNeSBSb290IENBMB4XDTA4MDMwNjAyMjMyMloXDTE4MDMwNDAyMjMyMlowczEL
MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBG
cmFuY2lzY28xEDAOBgNVBAoTB09wZW4gQ0ExEDAOBgNVBAsTB09wZW4gQ0ExEzAR
BgNVBAMTCk15IFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQC0ZkgO33sedYRMyXlbQf6HNVN5QPceR1hO0EfrRFgjUSENVH815EjnpsVAALzr
uDx6b+IP0+Z4PUQQrn0Cr9HS+3aS4c3Wfa+c+706bNDRzuxcFpUUXTEkAZ+5mKrk
UkSzUMROVz57Wk+SpHSuN/lNuuqBD30WrmuS5lB2YB5vsaySaXynbT7aDiELqwU1
37+kaS/86KQZo1k7VafyQk/Qs5ymhj1rO33++AgstGcZ2HxmM+anT7ekAPCpp+7A
/qa/zVLVBu5ItP4o9rAsFW8Wg0MVsUW7p4WqLB5pUfC0Op9fgFYcbGyGof3HHrjh
WHBtz4T0LwGA95lPImL/oLuBAgMBAAGjgdgwgdUwHQYDVR0OBBYEFBjex/BEYHmd
tDfc7C10VJ8ylkS4MIGlBgNVHSMEgZ0wgZqAFBjex/BEYHmdtDfc7C10VJ8ylkS4
oXekdTBzMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
BxMNU2FuIEZyYW5jaXNjbzEQMA4GA1UEChMHT3BlbiBDQTEQMA4GA1UECxMHT3Bl
biBDQTETMBEGA1UEAxMKTXkgUm9vdCBDQYIJAPZFB8IV4uO/MAwGA1UdEwQFMAMB
Af8wDQYJKoZIhvcNAQEFBQADggEBABl87rPX4IZ4ccXQUhnjohyphhY8pr7Ij///
3IYfIE+lSMSehED8jgiFrxwIeY4RMZY3emhvc5XJ6AfetAPljMC4FFxL4kGPM21Q
hDdgJumpWxIV12gsN7Clt1f2ZhP4xuDMCVq8igccQzkorgocX4AszvBnv0PIDRT8
5GL8T3cojI0bEdU4oZr/GKn5Sx2a5gy89SiruAxNZXf9XoyH2IszKmTOq3mDC5Dw
dQAqiA8FYE6abXGCHd4HOB/MZBkLIlNHB+lAW9XxUKo6x44P70TaMmzLFkneyJCj
/o1UbYI1WOU41PeFTjucnwVMjyutbbsH/ZJK5Lf5oxjDcip+zJ0=
-----END CERTIFICATE-----
Still very cute. If you are really wondering what's inside anyway, you can display it using x509 utility.
Display a certificate
C:\OpenSSL\myCA>openssl x509 -in cacert.pem -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
f6:45:07:c2:15:e2:e3:bf
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=California, L=San Francisco, O=Open CA, OU=Open CA, CN=
My Root CA
Validity
Not Before: Mar 6 02:23:22 2008 GMT
Not After : Mar 4 02:23:22 2018 GMT
Subject: C=US, ST=California, L=San Francisco, O=Open CA, OU=Open CA, CN
=My Root CA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit):
00:b4:66:48:0e:df:7b:1e:75:84:4c:c9:79:5b:41:
fe:87:35:53:79:40:f7:1e:47:58:4e:d0:47:eb:44:
58:23:51:21:0d:54:7f:35:e4:48:e7:a6:c5:40:00:
bc:eb:b8:3c:7a:6f:e2:0f:d3:e6:78:3d:44:10:ae:
7d:02:af:d1:d2:fb:76:92:e1:cd:d6:7d:af:9c:fb:
bd:3a:6c:d0:d1:ce:ec:5c:16:95:14:5d:31:24:01:
9f:b9:98:aa:e4:52:44:b3:50:c4:4e:57:3e:7b:5a:
4f:92:a4:74:ae:37:f9:4d:ba:ea:81:0f:7d:16:ae:
6b:92:e6:50:76:60:1e:6f:b1:ac:92:69:7c:a7:6d:
3e:da:0e:21:0b:ab:05:35:df:bf:a4:69:2f:fc:e8:
a4:19:a3:59:3b:55:a7:f2:42:4f:d0:b3:9c:a6:86:
3d:6b:3b:7d:fe:f8:08:2c:b4:67:19:d8:7c:66:33:
e6:a7:4f:b7:a4:00:f0:a9:a7:ee:c0:fe:a6:bf:cd:
52:d5:06:ee:48:b4:fe:28:f6:b0:2c:15:6f:16:83:
43:15:b1:45:bb:a7:85:aa:2c:1e:69:51:f0:b4:3a:
9f:5f:80:56:1c:6c:6c:86:a1:fd:c7:1e:b8:e1:58:
70:6d:cf:84:f4:2f:01:80:f7:99:4f:22:62:ff:a0:
bb:81
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
18:DE:C7:F0:44:60:79:9D:B4:37:DC:EC:2D:74:54:9F:32:96:44:B8
X509v3 Authority Key Identifier:
keyid:18:DE:C7:F0:44:60:79:9D:B4:37:DC:EC:2D:74:54:9F:32:96:44:B
8
DirName:/C=US/ST=California/L=San Francisco/O=Open CA/OU=Open CA
/CN=My Root CA
serial:F6:45:07:C2:15:E2:E3:BF
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
19:7c:ee:b3:d7:e0:86:78:71:c5:d0:52:19:e3:a2:1c:a9:86:
16:3c:a6:be:c8:8f:ff:ff:dc:86:1f:20:4f:a5:48:c4:9e:84:
40:fc:8e:08:85:af:1c:08:79:8e:11:31:96:37:7a:68:6f:73:
95:c9:e8:07:de:b4:03:e5:8c:c0:b8:14:5c:4b:e2:41:8f:33:
6d:50:84:37:60:26:e9:a9:5b:12:15:d7:68:2c:37:b0:a5:b7:
57:f6:66:13:f8:c6:e0:cc:09:5a:bc:8a:07:1c:43:39:28:ae:
0a:1c:5f:80:2c:ce:f0:67:bf:43:c8:0d:14:fc:e4:62:fc:4f:
77:28:8c:8d:1b:11:d5:38:a1:9a:ff:18:a9:f9:4b:1d:9a:e6:
0c:bc:f5:28:ab:b8:0c:4d:65:77:fd:5e:8c:87:d8:8b:33:2a:
64:ce:ab:79:83:0b:90:f0:75:00:2a:88:0f:05:60:4e:9a:6d:
71:82:1d:de:07:38:1f:cc:64:19:0b:22:53:47:07:e9:40:5b:
d5:f1:50:aa:3a:c7:8e:0f:ef:44:da:32:6c:cb:16:49:de:c8:
90:a3:fe:8d:54:6d:82:35:58:e5:38:d4:f7:85:4e:3b:9c:9f:
05:4c:8f:2b:ad:6d:bb:07:fd:92:4a:e4:b7:f9:a3:18:c3:72:
2a:7e:cc:9d
Now you have a root Certification Authority. You can sign any certificate requests and maintain a database of all certificates you have issued. Also, you can revoke any certificates and publish a Certificate Revocation List (CRL).
The big challenge left is how to make your CA, essentially your root CA's certificate, publicly aware. Before you release your certificate to public, you probably want to strip the certificate from all its text to keep only the -CERTIFICATE- section and change the file type from .pem to .cer -- just to make your certificate easier to be identified and imported on the client side.
Trim a certificate
C:\OpenSSL\myCA>openssl x509 -in cacert.pem -out cacert.cer
References:
