Specify sub_ca_ext for the extensions switch on the command line. Submit the CSR to the root CA and use the root CA to issue and sign the subordinate CA certificate. openssl req -new -config nf -out subca.csr -keyout private/subca.key Use the configuration file to generate a key and a certificate signing request (CSR). Having a subordinate CA does, however, mimic real world certificate hierarchies in which the root CA is kept offline and subordinate CAs issue client certificates. Because you can use the root CA to sign certificates, creating a subordinate CA isn’t strictly necessary. This example shows you how to create a subordinate or registration CA. Different certificates cannot have the same serial number. You must create a new serial number for every subordinate CA certificate and every device certificate that you create.

Ĭreate a new serial number in the rootca/db/serial file for the subordinate CA certificate. Step 5 - Create a subordinate CA configuration fileĬreate a configuration file and save it as nf in the subca directory. Step 4 - Create the subordinate CA directory structureĬreate a directory structure for the subordinate CA. openssl ca -selfsign -config nf -in rootca.csr -out rootca.crt -extensions ca_ext Sign the certificate, and commit it to the database. These indicate that the certificate is for a root CA and can be used to sign certificates and certificate revocation lists (CRLs). Specify the ca_ext configuration file extensions on the command line. Self-signing is suitable for testing purposes. Next, create a self-signed CA certificate. openssl req -new -config nf -out rootca.csr -keyout private/rootca.key Name_opt = utf8,esc_ctrl,multiline,lname,alignīasicConstraints = critical,CA:true,pathlen:0įirst, generate the key and the certificate signing request (CSR) in the rootca directory. Īia_url = crl_url = default_ca = ca_default Step 2 - Create a root CA configuration fileīefore creating a CA, create a configuration file and save it as nf in the rootca directory.

The private directory stores the CA private key.

The db directory is used for the certificate database.

The certs directory stores new certificates.

Step 1 - Create the root CA directory structureĬreate a directory structure for the certification authority. This is presented for example purposes only. The example then signs the subordinate CA and the device certificate into a certificate hierarchy. The following example uses OpenSSL and the OpenSSL Cookbook to create a certification authority (CA), a subordinate CA, and a device certificate. Although you can purchase X.509 certificates from a trusted certification authority, creating your own test certificate hierarchy or using self-signed certificates is adequate for testing IoT hub device authentication.

X mirage enter key