[Music]
hey everyone this is Kevin from web.net
and in this we episode I'm going to do a
very short presentation on how to create
your own self-sign x509 signing
certificate now this is a question that
has come into the web.net mailbag where
uh developers who are just creating some
test software and they want to do
digital signatures and they've asked you
know how do you create a self-signed
certificate well you can Google it and
you can find tons of different ways to
do it um I've always found that this is
easier just to use open SSL and what I'm
going to do in this presentation is I'm
going to show how to create your own
self- sign certificate and encapsulate
the uh the certificate and the private
key into a pfx file and then export the
public key and that public key can then
be given out to other clients for
certificate trusts I do plan on having a
a follow-up video where I take the
private key and the public key key and
then I actually will do a digital
signature on XML document just to kind
of show the application on how it works
I'll describe a little bit more about
how that works so anyways here we go
ladies and gentlemen so the first thing
that I want to do is run out to the
internet and on This Server machine that
I'm working on here I don't have open
SSL installed on it yet but what I'm
going to do is go through the process of
doing that all right so I'm just going
to Google and I'm just going to search
for download op SSL and let's look for
the SSL binary distributions and in this
particular case I'm using Windows if
you're using Linux you can use itude to
get it if you're using Debian or yum or
whatever you know you you would use to
install it in Linux um so let's go to
here and you'll see that there are
multiple distributions though I I
typically go for the full version
there's like the light version but you
know I'm hardcore right so I go for the
full version so this is the first
instance of the full version Windows
32bit op SSL version 1. blah and I
typically know that it's full version
because it's it's a bigger archive or a
bigger installer file so let's go ahead
and download this executable awesome and
then let's launch it all right so we'll
just follow this through like a regular
Windows installer next I accept next C
open SSL that's perfectly fine for my
purposes and um and I'm not going to
worry about copying the SSL dlls to a
different the Windows system folder cuz
I'm not going to be using them so I'll
just the open SSL binary folder is
perfectly fine next install here we go
cool and I would like to donate but um
some other time guys all right wonderful
here we go so the next step is going to
be that um I'm going to just just like
we would normally do I'm going to run
out to here and go to the bin folder I'm
going to put this in our system path
just like we've done with our other
tutorials so right click on this PC go
to properties Advanced system settings
and then environment variables and then
path edit go to the end semicolon
paste all right okay and we should be in
shape at this point to start using it so
let's open up the command prompts all
right and I'm just going to run out to
the desktop that way we can see the
files showing up on the desktop there
all right so if I just type open SSL
oops if I can spell it correctly cool I
can actually see that open SSL The
Prompt is actually showing up which is
fantastic so let's go through the
process of creating a simple x509
certificate that we will be using for
digital signatures we'll do an open SSL
and then the re q- x509 and then the
number of days that this is going to be
uh you until this expires we'll just do
like 365 so this is going to expire in a
year from this this date Das new key RSA
and then however many bits you want to
use which you know 2048 it seems to be
pretty decent and then the dash key outs
and I'm sorry that we're actually losing
this let me see if I can I make this
bigger me see if I can do this real
quick all right so we'll try to work
with this I have my scrolly thing here
so we can follow this out all right
anyways let's continue open SSL so req
means that this is a Certificate request
and it's an x509 certificate that's
going to be available so it's not going
to expire for 365 days new key means
that we're going to make a new
certificate and then RSA 21t 48 bits so
key out is going to be the key file so
this is going to be what what stores our
key so we'll just call this
my.pen and then let's then do out I'm
sorry this will be my key.pem and now
let's push the CT out to dash out this
will be my cert.pem all right so that's
going to make us go through this process
of creating stuff and adding stuff so
let's just create a password for this
we'll just I'll just make it's something
simple for me I'll just call it um um 1
2 3 4 5 6 7 8 9 0 it's going to make me
confirm it 1 2 3 4 5 6 7 8 90 okay so
the country name I'll just say United
States the state the DC the city we'll
call it Washington organization name so
the company name we'll just call this
wibbit Donnet in my case organizational
unit uh we'll just call this software
engineering common name we'll just do
www.wi it.net yeah email address support
at web.net all right so now if I look at
my desktop look at this I have a pem
file and a pen file so I have my key and
my CT so now let's put this into a pfx
file so we'll have both of them in a
single file and we can do this very
easily open SSL
pkcs1 12- exorts so we're going to
export the input is going to be first
we'll do the seert file so this will be
my cert. pen and then the in key is
going to be my search my key. pen and
I'm going to push this out to webit test
search.
pfx all right so it's going to go
through this it wants me to put in my
password that I locked it with one 2 3 4
5 6 7 8 90 and then it wants me to
create an export so that the pfx file
has a password on it now I'll just go
ahead and use the same password 1 2 3 4
5 6 7 8 9 0 enter it again 1 2 3 4 5 6 7
890 boom shakka all right so at this
point what I can do I can actually just
take these two files I can keep them and
I should keep them but for the purposes
of this I'm going to delete them because
all that I'm going to be doing is
working with this so what I can do is if
I'm creating a digital signature I can
use the private key it's installed
that's encapsulated here to sign my
document and then I could use the public
key to verify the signature so what I'm
going to do now is I will export a
public key and I will end this video
with the pfx file in one hand this will
be me I keep this as the secret person
as you know the person that wants to
establish the trust I will keep this and
then the public key will be what I can
hand out to my clients and then we'll
come back at a later time and we'll
actually do a digital signature so here
we go let's actually export a public key
open SSL and then we'll do uh
pkcs12 and then the input is going to be
the pfx file-
cs- no keys D outs and then we'll just
call this test
ct. pem all right enter the import
password 1 2 3 4 5 6 7 8 9 0 and it's
good to go so we'll minimize this here
we go here is my public and here is my
pfx that contains both my public and my
private so that's how you can make a
simple x509 signing certificate public
and private for your digital
[Music]
signatures