Page History

# Specify server for which the certificate should be created
certificate_name=signing

# Step 1 - Generate Private Key and Certificate Signing Request
openssl req -new -config openssl-cert.config -extensions 'standard exts' -nodes \
    -days 5475 -newkey ec:<(openssl ecparam -name prime256v1)rsa:4096 -keyout ${certificate_name}.key -out ${certificate_name}.csr

# Step 2 - Generate and sign the Server Certificate
openssl x509 -req \
    -in ${certificate_name}.csr \
    -CA signing-ca.crt \
    -CAkey signing-ca.key \
    -CAcreateserial \
    -out ${certificate_name}.crt -days 7300 \
    -extfile <(printf 'keyUsage = critical, nonRepudiation, digitalSignature\n' "${certificate_name}")