X.509

Certificate Authority (CA)

Certificate validation

Install a self-signed CA certificate

  • Windows 10

    certutil –addstore -enterprise –f "Root" <pem-file>
    • Open Run dialog, type certmgr.msc
    • The imported certificate will show up under Trusted Root Certification Authorities - Certificates

  • Ubuntu

    Add

    sudo mkdir /usr/local/share/ca-certificates/extra
sudo cp CA.cert.pem /usr/local/share/ca-certificates/extra/CA.cert.crt
sudo update-ca-certificates

    Remove

    sudo rm /usr/local/share/ca-certificates/extra/CA.cert.crt
sudo update-ca-certificates  # This will remove the symlink under /etc/ssl/certs

  • Fedora

    Add

    sudo trust anchor "$CA_certificate.pem"
 
# or manually
sudo cp "$CA.cert.pem" /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

    Remove

    sudo trust anchor --remove path.to/certificate.crt
 
# or manually
sudo rm /etc/pki/ca-trust/source/anchors/CA.cert.pem
sudo update-ca-trust

  • Application

DNS

  • The certificate is valid only if the request hostname matches the certificate Common Name (CN) or Subject Alternative Names

  • Multi-Domain (MD) or Subject Alternative Names (SAN) SSL Certificates

    Also commonly referred to as SAN certificates, multi-domain SSL allow a single certificate to secure multiple domains, including subdomains of a single main domain name or entirely different domain names. One of these can secure up to 250 unique domains with a single solution. They provide a convenient option for organizations that own a lot of domains and are looking for a simplified way to secure them through a single solution rather than purchasing an individual certificate for each. Multi-domain SSL certificates are available in DV, OV, and EV validation options.

  • Wildcard SSL Certificates

    The Wildcard option is used to secure the main domain and an unlimited number of subdomains under the main domain. For example, www.yourwebsite.com (opens in a new tab), login.yourwebsite.com, mail.yourwebsite.com, etc. Wildcard certificates offer full encryption for the subdomains, making them an affordable and effective solution for most websites. They are available in DV and OV validation options.

Private key

  • PKCS#8 - PEM base64-encoded format

CSR

  • CSR is generated and sent to a CA to request the issuance of a CA-signed SSL certificate.
  • CSR contains information for identification purposes, which will be stored into the CA-signed certificate along with CA's public key.
  • You can use OpenSSL to generate a new private key and a CSR, or generate a CSR from an existing private key.
  • Format: PKCS#10
  • Wikipedia - CSR (opens in a new tab)

Serial number

  • A number that uniquely identifies the certificate and is issued by the CA.

Thumbprint / Fingerprint

  • A certificate's fingerprint is the unique identifier of the certificate. It is the hash value of the entire certificate in DER format. A certificate could have multiple fingerprints computed by different hash functions such as SHA-256. Certificate details in web browser include fingerprints.

  • sha256sum / sha1sum $crt.der | tr '[:lower:]' '[:upper:]'

    should get the same hash value as:

    openssl s_client -connect <host>:<port> 2>/dev/null | openssl x509 -noout -fingerprint -sha256/-sha1

Certificate Formats

Key usage

Java (JSSE)

ACME (Automatic Certificate Management Environment)

Certbot

$ sudo certbot --nginx
 
Saving debug log to /var/log/letsencrypt/letsencrypt.log
 
Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: crystallover.com.au
2: www.crystallover.com.au
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Requesting a certificate for crystallover.com.au and www.crystallover.com.au
 
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/crystallover.com.au/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/crystallover.com.au/privkey.pem
This certificate expires on 2024-03-13.
These files will be updated when the certificate renews.
 
Deploying certificate
Successfully deployed certificate for crystallover.com.au to /etc/nginx/conf.d/crystallover.conf
Successfully deployed certificate for www.crystallover.com.au to /etc/nginx/conf.d/crystallover.conf
Congratulations! You have successfully enabled HTTPS on https://crystallover.com.au and https://www.crystallover.com.au
 
NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Resources

SELinuxLinux Kernel