In Debian GNU/Linux are located in /usr/lib/ssl/misc/
$ /usr/lib/ssl/misc/CA.pl -newca CA certificate filename (or enter to create) <press enter> Making CA certificate ... Generating a 1024 bit RSA private key .............++++++ .......................................++++++ writing new private key to './demoCA/private/cakey.pem' Enter PEM pass phrase: <type the secret phrase again> Verifying - Enter PEM pass phrase: <type the secret phrase again> ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:ES State or Province Name (full name) [Some-State]:. Locality Name (eg, city) []:. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Cherokee Team Organizational Unit Name (eg, section) []:<Enter> Common Name (eg, YOUR name) []:Cherokee Certificate Master Email Address []:alvaro@alobbs.com
$ /usr/lib/ssl/misc/CA.pl -newreq Generating a 1024 bit RSA private key .....................................++++++ ...++++++ writing new private key to 'newreq.pem' Enter PEM pass phrase: <anothe phrase> Verifying - Enter PEM pass phrase: <repeat it> ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:ES State or Province Name (full name) [Some-State]:. Locality Name (eg, city) []:. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Cherokee web server Organizational Unit Name (eg, section) []:. Common Name (eg, YOUR name) []:www.0x50.org Email Address []:sysop@0x50.org Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: <Enter> An optional company name []: <Enter> Request (and private key) is in newreq.pem
$ /usr/lib/ssl/misc/CA.pl -sign Using configuration from /usr/lib/ssl/openssl.cnf Enter pass phrase for ./demoCA/private/cakey.pem: Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Aug 17 13:12:44 2003 GMT Not After : Aug 16 13:12:44 2004 GMT Subject: countryName = ES organizationName = Cherokee web server commonName = www.0x50.org emailAddress = sysop@0x50.org X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 14:6A:45:66:A2:EB:73:74:5A:C5:68:80:50:D5:48:94:DD:ED:25:F7 X509v3 Authority Key Identifier: keyid:9E:E0:E2:6E:1B:02:17:F2:72:C9:0D:E3:DA:C9:E1:8F:CE:BC:6E:A2 DirName:/C=ES/ST=Madrid/L=Madrid/O=Cherokee Team/CN=Cherokee Certificate Master/emailAddress=alvaro@alobbs.com serial:00 Certificate is to be certified until Aug 16 13:12:44 2004 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated Signed certificate is in newcert.pem
It's another way to generate certificate files. Ramon Pons sent this little script to create self signed certificates:
#!/bin/sh CERTNAME=cherokee.pem openssl req -days 1000 -new -x509 -nodes -out $CERTNAME -keyout $CERTNAME chmod 600 $CERTNAME openssl verify $CERTNAME if [ $? != 0 ]; then \mv $CERTNAME $CERTNAME.not_valid fi