You can use the ca utility to create X.509 certificates by signing existing signing requests. It is imperative that you check the details of a certificate request before signing. Your organization should have a policy with respect to issuing certificates.
The ca utility is used to sign certificate requests thereby
creating a valid X.509 certificate which can be returned to the request
submitter. It can also be used to generate Certificate Revocation Lists (CRLS).
For information on the ca
-policy and -name options, refer to The OpenSSL Configuration File .
To create a new CA using the openssl ca utility, two files
(serial and index.txt) must be created
in the location specified by the openssl configuration file that you are using.
The options supported by the openssl ca utility are as follows:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Most of the above parameters have default values as defined in
openssl.cnf.
Converting a private key to PEM format from DER format requires the
ca utility. To sign the supplied CSR
MyReq.pem to be valid for 365 days and to create a new X.509
certificate in PEM format, use the ca utility as follows:
openssl ca -config ssl_conf_path_name -days 365
-in MyReq.pem -out MyNewCert.pem







