Simple SSL Certificate Authority 
Monday, 22 March 2004, 00:00 - Tools & more, OpenSSL
Sometimes, you need some SSL certificates for providing SSL encrypted pages.

You can obtain a server certificate from Verisign or Entrust but they're quite expensive.

Or you can make them yourself. Here are some tools to get there. I won't provide information about cryptology at all, neither you will find a professional PKI solution here.

Creating your "own CA" makes only sense for sites where encryption should be in place, without providing official trusted credentials. Every user connecting to your secured site get a warning message every time he connects to your site, until he manually accept your CA Certificate.

First you need OpenSSL, the code which deals with digital certificates.
For information on the command options of the OpenSSL tools look at the OpenSSL Documentation (from
Then get the SSL CA-Tools 0.2 (SSL CA-Tools 0.2). This is a version slightly modified so you can also renew certificates easily.
If you do prefer to use the original version, you can find it here: SSL CA-Tools)

The SSL CA-Tools are easy to use scripts which query the necessary information in a dialog and execute the appropriate openssl commands. Untar it somewhere, e.g. under your openssl directory, look at the README, and create a self-signed CA certificate, user- and server certificates and finally sign them with your CA key.


Administrator (Mike Rhyner) 
Wednesday, 3 November 2021, 18:37
To "renew" the root ca cert, so there's no need to re-issue all client-certificates:

Create a certificate request out of the current ca cert:
openssl x509 -x509toreq -in ca.crt -signkey ca.key -out new-ca.csr

Issue a new CA certificate (using the original private key):
openssl x509 -req -days 1825 -in new-ca.csr -signkey ca.key -out new-ca.crt

Then put or exchange the CA certificate file "new-ca.crt" everywhere you verify client certificates issued by your own CA, e.g. for the apache config option "SSLCACertificateFile".

Add Comment
Fill out the form below to add your own comments.

Insert Special:

Moderation is turned on for this blog. Your comment will require the administrators approval before it will be visible.