In this video, we show how to create a Certificate Authority Server using OpenSSL A number of IT devices are managed through a web browser but these are supplied with a self-signed certificate Aside from the annoying warning from the web browser that the certificate is not trusted, it's not a good security practice to use self-signed certificates Instead, if you only use signed certificates from a certificate authority your web browser trusts, you are much more likely to spot a suspicious web site, whether private or public and avoid it Once set up properly, the CA server can issue certificates to computers on your network and you can then connect to them securely through a web browser We will be using an Ubuntu server for this installation but OpenSSL is available on other platforms NOTE: In a large environment it is best to set up intermediary CA servers as well However, given the lack of interest the likes of Google has in certificate revocation, we will only create a Root CA Because if the intermediary server is compromised, it would be easier to replace the Root CA NOTE: Google Chrome web browser insist on a Subject Alternate Name in the certificate, even if the server has only one name Useful links: https://www.openssl.org/docs/manpages.html https://www.openssl.org/docs/manmaster/man1/openssl.html https://www.openssl.org/docs/man1.0.2/man1/ca.html https://www.openssl.org/docs/manmaster/man5/x509v3_config.html https://www.openssl.org/docs/man1.0.2/man1/openssl-req.html ============================= SUPPORT THE CHANNEL Donate through Paypal: https://paypal.me/DavidMcKone Donate through Buy Me A Coffee: https://buymeacoffee.com/dmckone Become a monthly contributor on Patreon: https://www.patreon.com/dmckone Become a monthly contributor on YouTube: null ============================== ============================== MEDIA LINKS: Website - https://www.techtutorials.tv/ Twitter - https://twitter.com/dsmckone1 Facebook - https://facebook.com/dsmckone Linkedin - https://www.linkedin.com/in/dmckone Instagram - https://www.instagram.com/david.mckone ============================== Steps taken: 1) Create the Root CA VM Create a VM to install Ubuntu server for instance (1vCPU, 1GB RAM, 16GB HDD, 1vNIC) During the install process, opt to encrypt the disk and to install OpenSSH However, do not install any other applications when prompted 2) Basic configuration After enabling UFW, create folders for the CA mkdir -p ca/{private,certs,newcerts,csr} chmod -v 700 ca/private Create an index file and serial file for the CA touch ca/index openssl rand -hex 16 ca/serial NOTE: Check the video as the last line is missing redirect symbol which the description box does not accept 3) Create the Root CA private key cd ca openssl genrsa -aes256 -out private/root-ca.key 4096 4) Create the CA config file See comment 5) Create the root CA self-signed certificate openssl req -config root-ca.conf -extensions v3_ca -key private/root-ca.key -new -x509 -days 3650 -out certs/root-ca.crt 6) Create a server private key openssl genrsa -out private/testserver.key 2048 7) Create a server CSR, using a config file See comment openssl req -new -key private/testserver.key -sha256 -out csr/testserver.csr -config csr/testserver-csr.conf Check for the SAN openssl req -noout -text -in csr/testserver.csr | grep -A 1 "Subject Alt" 8) Sign the server certificate request openssl ca -config root-ca.conf -notext -in csr/testserver.csr -out certs/testserver.crt -extensions req_ext -extfile csr/testserver-csr.conf Check for the SAN openssl x509 -text -noout -in certs/testserver.crt | grep -A 1 "Subject Alt" 9) Configure web browser to trust the root CA Firefox Settings | Privacy & Security | View Certificates | Authorities | Import Brave Settings | Privacy & Security | Security | Manage certificates | Authorities | Import 10) Upload private key and certificate to the server, configure it to use these, then test on web browser ===================================== Credits: LoveLife | Instrumental Prod. Blue Mango | EQMUSEQ.COM by Don Da Vinci https://soundcloud.com/eqmuseq/lovelife?in=eqmuseq/sets/royalty-free-music-for-youtube openssl install,openssl install linux,openssl install ubuntu,openssl config file,ssl certificate,certificate authority,openssl ubuntu,openssl install ubuntu 20.04,openssl ubuntu 20.04,openssl ubuntu 20.04 install,ca server,certificate authority server,openssl ca server,openssl certificate authority server,how to create ca server,how to create certificate server,openssl,openssl installation 00:00 Intro 01:56 Timelines 02:30 Why create a CA? 08:09 How it works 13:20 Virtualization 16:00 Certificate revocation 24:08 Build VM 28:27 Initial set up 39:30 CA private key 49:34 Open SSL config file 59:28 CA certificate 01:11:40 Server private key 01:14:04 Server CSR 01:21:15 Sign CSR 01:30:34 Install Root certificate and test CA Server - OpenSSL