Ygtjki

I want to generate a self-signed certificate with SHA256 or SHA512, but I have problems with it. I have created a script, which should does this automatically:

#!/bin/bash

set -e

echo "WORKSPACE: $WORKSPACE"

SSL_DIR=$(pwd)/httpd_ssl_certs
OPENSSL_CNF=$(pwd)/openssl.cnf

if [ -d "$SSL_DIR" ]; then
 rm -rvf "$SSL_DIR"
fi

mkdir -vp "$SSL_DIR"

pushd "$SSL_DIR"

# check if openssl.cnf exists
if [ ! -f "$OPENSSL_CNF" ]; then
 echo "Could not find $OPENSSL_CNF. Build will be exited."
 exit 1
fi

echo " - create private key"
openssl genrsa -out server.key.template 2048
echo " - create signing request"
openssl req -nodes -new -sha256 -config $OPENSSL_CNF -key server.key.template -out server.csr.template
echo " - create certificate"
openssl x509 -req -in server.csr.template -signkey server.key.template -out server.crt.template -extfile $OPENSSL_CNF

And I have a openssl.cnf file with configuration for it:

[ ca ]
default_ca = CA_default

[ CA_default ]
# how long to certify
default_days = 365
# how long before next CRL
default_crl_days = 30
# use public key default MD
default_md = sha256

# keep passed DN ordering
preserve = no

policy = policy_anything

[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional

[ req ]
default_bits = 2048
default_keyfile = server.key.template
distinguished_name = req_distinguished_name
prompt = no
encrypt_key = no
# add default_md to [ req ] for creating certificates with SHA256
default_md = sha256

[ req_distinguished_name ]
countryName = "AB"
stateOrProvinceName = "CD"
localityName = "Some town"
organizationName = "XXX Y"
organizationalUnitName = "XXX Y"
commonName = "localhost"
emailAddress = "somemail@some.org"

When I run the script with this openssl.cnf, then I get a certifiacte, but this certificate is always encrypted with SHA1. I checked it with this command: openssl x509 -in server.crt.template -text -noout | grep 'Signature. I always get this output:

Signature Algorithm: sha1WithRSAEncryption
Signature Algorithm: sha1WithRSAEncryption

Can someone give me a hint, whats false there?

The following is my pertinent notes on generating, albeit not certificates themselves, a Certificate Signing Request (CSR) with openssl.

The syntax with placeholders looks like this:

openssl req -new -newkey rsa:4096 -sha256 -nodes -out
DOMAIN.TLD.rsa.csr -keyout DOMAIN.TLD.rsa.pkey -subj
"/C=US/ST=/L=CITY/O=COMPANY-NAME/CN=DOMAIN.TLD"

This is the exact command I used to generate my own CSR, which I give to my SSL certificate provider.

openssl req -new -newkey rsa:4096 -sha256 -nodes -out rustbeltrebellion.com.csr -keyout rustbeltrebellion.rsa.pkey -subj "/C=US/ST=OHIO/L=EASTLAKE/O=RUSTBELTREBELLION/CN=RUSTBELTREBELLION.COM"

The benefit of a CSR is that your private key stays more private. I am aware of only two ways to create a certificate-- by running your private key through the openssl library or your CSR through the openssl library. Both give you a functionally identical certificate when the dust settles. One allows your private key to remain private (the CSR does that).