LINUX (Ubuntu 14.04) Selfsign CA

This topic also do the same work as previous "MS Window CA". This topic would be tried on Linux:

I would like to setup my own internal Certification Authority (CA) on Ubuntu 14.04. Using certificates signed by my own CA, allows the Window IIS Web services using the certificates.

First, create the directories to hold the CA certificate and related files

mkdir /etc/ssl/CA
mkdir /etc/ssl/newcerts

The CA needs a few additional files to operate, one to keep track of the last serial number used by the CA, each certificate must have a unique serial number, and another file to record which certificates have been issued:

sh -c "echo '01' > /etc/ssl/CA/serial"
touch /etc/ssl/CA/index.txt

Edit /etc/ssl/openssl.cnf, and in the [ CA_default ] change:

Next, create the self-signed root certificate:

openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650

Now install (copy) the root certificate and key:

mv cakey.pem /etc/ssl/private/
mv cacert.pem /etc/ssl/certs/

You are now ready to start signing certificates
To generate the keys for the Certificate Signing Request (CSR) run the following command from a terminal prompt, first, create private key for using to generate CSR:

openssl genrsa -des3 -out pk.key 2048
openssl rsa -in pk.key -out pubk.key

With pk.key is private key secured with passphrase and pubk.key is private key un-secured.

Then create the CSR, run the following command at a terminal prompt:

openssl req -new -key pubk.key -out web.csr

Your CSR will be created and it will be stored in the web.csr file.

You can now submit this CSR file to a CA for processing. The CA will use this CSR file and issue the certificate. On the other hand, you can create self-signed certificate using this CSR.

Please NOTE: The "Organization Name" would be the same to CA information, otherwise you might get in error when issue the below command.

Once you have a CSR, enter the following to generate a certificate signed by the CA:

openssl ca -in web.csr -config /etc/ssl/openssl.cnf

After entering the password for the CA key, you will be prompted to sign the certificate, and again to commit the new certificate. You should then see a somewhat large amount of output related to the certificate creation. The example here

There should now be a new file automatically created /etc/ssl/newcerts/01.pem (and if we re-run the command for signing new CSR file, the new .pem files also automatically created in /etc/ssl/newcerts/ with the name sequence 02.pem, 03.pem, 04.pem...).
Open the /etc/ssl/newcerts/01.pem file then copy and paste everything beginning with the line:
-----BEGIN CERTIFICATE-----

and continuing through the line:

----END CERTIFICATE-----

to a new file named nhut.crt (for easy to remember). So, the nhut.crt would be

-----BEGIN CERTIFICATE----- 

<hash line>

----END CERTIFICATE----- 

Now, we have certificate nhut.crt, but our purpose is to use this certificate for applying Window IIS Website. The next step will be convert this certificate file to Window format, we need 3 kind of file to do this conversion:
=> The private key : pk.key
=> The certificate file need to be converted: nhut.crt
=> The certificate file of CA: /etc/ssl/certs/cacert.pem

openssl pkcs12 -export -out window_cert.pfx -inkey pk.key -in nhut.crt -certfile cacert.pem

Or we can copy /etc/ssl/certs/cacert.pem to cacert.crt for futher using.

(s.key in above picture is the same to pk.key, and cacert.crt ~ cacert.pem).

Enter password for export, copy this window_cert.pfx to window server, import to My computer.
Configure IIS for using this certificate:

The result showed (don't worry, the host name here might be www.nhut.com, or www.nhutnb.com depend on the "Common Name" we created before *.nhut.com or *.nhutnb.com... ):

Source: https://help.ubuntu.com/lts/serverguide/certificates-and-security.html

MS Window Selfsign CA

Step 1: Install Certificate CA on Server window. Assuming this taks is already done.

Step 2: Request Certificate for Web Server (5 picture below)

#Request a certificate

 #Advanced...

 #Create and submit a request to this CA

 #Fill the information. But NOTE:

The Name field: that should be put right name for domain or host address if you want your site is accessed without "mismatch URL" errors.

For example: your site would be access via www.nhutnb.com or web.nhutnb.com that using this certificate. Put *.nhutnb.com to the Name field.

 Type of Certificate Needed should be : Server Authentication...

Affter issued from CA administrator. You can download the certificate and install to the Web Server

Then check whether your installed certificate is in correct location

If the certificate is not correct location (Local Computer instead of User Account). Just do a copy and paste (or you can using export then import functionality).

If the location is correct, then copy *.nhutnb.com in Personal folder to Trusted Root Certification Authorities folder (just do copy and paste)

Now. Open your IIS and check Server Certificate

There it is.
Now, but do one more task to make sure the hostname in "binding" dialog be availabled for you to edit:
Reopen MMC console and navigate to the certificate => click Properties => then type to the "Friendly name" field as picture:

 If you already done this, you could change the "host name" when change the binding configure in IIS,

 Otherwise, you will get this:

Now, create the website:

Then check the result

If you are using the client browser that has not trusted this certificate, your browser might issue a warning, that because your certificate is using for local. If you don't want to get this warning, just install that certificate into your client computer (on both Personal and Trusted Root Certification Authorities folder).