Page History

...

Creating a Signing Certificate

Download: create_serversigning_certificate.sh

The following files will be created with <server> <user> being a placeholder for the hostname user for which a certificate should be created.

• <ca>/certs/<server><user>.crt
• <ca>/csr/<server><user>.csr
• <ca>/private/<server><user>.key

This step is performed for each Server Signing Certificate that should be created.

# Description
# create_serversigning_certificate.sh --key-dns=<hostname>[,<hostname>]name=<basename> --ca-key-name=<basename> --subject=<distinguished-name> --days=<number-of-days>

# Example for use with DNSkey name and lifetime
# ./create_serversigning_certificate.sh --dns=centostest-primarykey-name=ap --days=365

# Example for use with DNSkey name, CA key name and lifetime
# ./create_serversigning_certificate.sh --dns=centostest-primary,centostest-primary.sos --key-name=ap --ca-key-name=centostestsigning-primaryca --days=4017

# Example for use with DNS,key name, subject and lifetime
# ./create_serversigning_certificate.sh --key-dns=centostest-primary,centostest-primary.sosname=ap --subject="/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=centostest-primary.sosap" --days=4017
 

The shell script is executed with the following arguments:

• --key-dns name (required)
  • The DNS hostname basename of the server that should be assigned the certificate. A server can be assigned more than one DNS hostname, for example the FQDN can extend the hostname. Only DNS hostnames that are added to the certificate can be used later on to establish secure HTTPS connections.key without extension. 
• --ca--key-name
  • The basename of the CA key without extension. Default: root-ca
• --subject
  • The distinguished name that is used as the subject of the Server Signing Certificate. Default: /C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=<dnskey-name>
  • The CN attribute must should specify the server's hostnameuser name. By default the first hostname key name specified with the --key-dnsname option is used.
• --days
  • The lifetime of the certificate is specified by the number of days. Default: 3652

...