-1

I need to get a certificate from a certificate authority with .crt extension. I used openssl commands but it generates a self-signed certificate which is not suitable for my use.

$ openssl genrsa -out client.key 4096
$ openssl req -new -x509 -text -key client.key -out client.cert

How can I obtain a certificate form a CA in Ubuntu 16.04? I need .key and .crt files.

Johannes
  • 828
  • 12
  • 29
Farhood Hosseinpour
  • 133
  • 2
  • 13
  • Different CA entities have different steps, like https://ca.godaddy.com/help/generate-a-csr-certificate-signing-request-5343. So check documentation of the CA you would like to use. – Lex Li Dec 05 '17 at 15:33

1 Answers1

3

These are the steps you would need to do to get a certificate signed by a CA.

  1. Generate a Asymmetric Key Pair.

openssl genrsa -out localhost.key 2048

  1. Generate a PKCS#10 (Certificate Signing Request) from the Key Pair.

openssl req -new -sha256 -key localhost.key -out localhost.csr

  1. Send the above generated request to the CA (different CA's have different ways of receiving your request).

  2. CA replies with a PKCS#7 (Certificate Chain) or just the signed certificate (you will usually get the entire certificate chain, but if you just got only the peer certificate, you can check with them where you can get the CA certificate chain to construct the chain yourself).

  3. You can convert the above received PKCS#7 to PEM format

openssl pkcs7 -in localhost.p7r -inform DER -out localhost.pem -print_certs

  1. Associate the above PEM certificate chain to the private key you generated in the step 1.

openssl pkcs12 -export -inkey localhost.key -in localhost.pem -name sslCertificate -out localhost.pfx

You now have a PKCS#12 keystore that you can use to secure your server.

So to answer you question, this is how you could proceed with step 3.

There are many well known Certificate Authorities out there (GeoTrust, Entrust, Verisign, GoDaddy, Comodo, etc, ...). Each CA could be different on their pricing depending on what kind of certificate you are requesting. You can visit their official web page(s) to know more about what they have to offer. Once you have decided which CA to go with, you use their service to request a certificate to be signed (usually online on their site).

always_a_rookie
  • 4,515
  • 1
  • 25
  • 46
  • Hi, Thanks for your solution. Is there any free way to get CA certificate? at this stage of my project, I cant pay for that. How it I make a CA of my own? – Farhood Hosseinpour Dec 07 '17 at 09:59
  • @FarhoodHosseinpour A quick google search brought up an open source CA `letsEncrypt`, and free SSL cert from `Comodo`. If it doesn't work for you, you could look into self-signed certificates. All you have to do is to add your self-signed certificates to the truststore. – always_a_rookie Dec 07 '17 at 14:38