Creating Self-Signed TLS Certificates

(see also: https://github.com/creachadair/tlsutil)

• Generate a self-signed certificate (Go stdlib)
• Generate a CA cert and a cert signed by it (Filippo)
• Test examples for certificate manipulations (Go stdlib)
• Generate and sign a certificate with a CA

A "CA" certificate is basically just a self-signed certificate that someone has blessed. There are a few pedantic details you have to get right in the cert settings if you want a browser to accept it (particularly an older browser), but CLI tools seem to be less picky.

Install CA Certificate (Debian/Ubuntu)

• Add .crt file to /usr/share/ca-certificates and run sudo update-ca-certificates.

It turns out this dance is not strictly necessary: Running the tool has the effect of "compiling" all the certificates selected by the configuration file into a single file /etc/ssl/certs/ca-certificates.crt. The compilation is nothing more than concatenating the PEM format of each cert end-for-end. A tool that wants to add a cert can just add it to the end of that file.

There is a bit more plumbing to consider:

• /etc/ca-certificates.conf is a text file that lists which keys should be picked up by the compiler. Each non-comment line names the path of a file under /usr/share/ca-certificates that should either be kept or skipped (a leading ! means to skip it). The dpkg-reconfigure plugin for ca-certificates has a TUI for editing this file, but emacs works too.
• Installed certificates are linked into /etc/ssl/certs, that is, a symlink in that directory points to the file actually containing the cert. This does not seem to be used except by the scripts that update the compiled file.

If you want a cert to survive restarts and reconfigurations (e.g., dpkg-reconfigure ca-certificates), you will also need to update those two locations.

Install CA Certificate (macOS)

# The cert file should be in PEM format.
sudo security add-trusted-cert -d -k /Library/Keychains/System.keychain test-signing-cert.pem

# To remove said cert:
sudo security remove-trusted-cert -d test-signing-cert.pem 

Note that this requires root (for write access) in addition to whatever other permissions the system wnats. Instructions lifted from mkcert.

You can also open Keychain Access and use the "Import" facility to pull in the PEM file containing the cert, and then bless the key as "trusted" by opening the "Get Info" window and clicking several times and issuing your thumbprint.

Checking Certificate and Key Files

Check a key file:

openssl ec -in test.key -check

Check a certificate:

openssl x509 -noout -text -in test.crt

View the cert chain from a server:

openssl s_client -showcerts -connect example.com:12345