openssl generate ca certificate

This generated certificate can be used in browsers, java, tomcat, c++, etc. Reminder here!


1. Create a root certificate private key
Command :
openssl genrsa -aes256 -out D:\abc\d\root-key.key 1024

2. Create a root certificate request file
Command :
openssl req -new -out D:\abc\d\ root-req.csr -key D:\abc\d\root-key.key -keyform PEM

3. Self-signed root certificate
Command :
openssl x509 -req -in D:\abc\d\root-req.csr -out D:\abc\d\root-cert.cer -signkey D:\abc\d\root-key.key -CAcreateserial -days 3650

4. Export root certificate in p12 format
Command :
openssl pkcs12 -export -clcerts -in D: \abc\d\root-cert.cer -inkey D:\abc\d\root-key.key -out D:\abc\d\root.p12

5. Generate root.jks file
keytool -import -v -trustcacerts -storepass 123456 -alias root -file D:\abc\d\root-cert.cer -keystore D:\abc\d\root.jks

Generate client file:
1. Generate client key
openssl genrsa -out client-key.key 1024
2. Generate client request file
openssl req -new -out client-req.csr -key client-key.key
3. Generate client certificate (root certificate , rootkey, client key, client request file, these 4 generate client certificate)
openssl x509 -req -in client-req.csr -out client-cert.cer -signkey client-key.key -CA root-cert. cer
-CAkey root-key.key -CAcreateserial -days 3650
4. Generate client p12 format root certificate
openssl pkcs12 -export -clcerts -in client-cert.cer -inkey client-key.key -out client.p12

client jks :
keytool -import -v -trustcacerts -storepass 123456 -alias client -file client-cert.cer -keystore
client.jks

Generate server file:
1. Generate server key
openssl genrsa -aes256 -out D:\abc\d\ server-key.key 1024
2. Generate server request file
openssl req -new -out D:\abc\d\server-req.csr -key D:\abc\d\server-key.key
3. Generate server certificates (root certificate, rootkey, client key, client request file these 4 generate client certificate)
openssl x509 -req -in D:\abc\d\server-req.csr -out D:\abc\d\server-cert.cer -signkey D:\abc\d \server-key.key -CA D:\abc\d\root-cert.cer -CAkey D:\abc\d\root-key.key -CAcreateserial -days 3650
4. Generate server-side p12 format root certificate
openssl pkcs12 -export -clcerts -in D:\abc\d\server-cert.cer -inkey D:\abc\d\server-key.key -out D:\abc\d\server.p12Server
JKS
keytool -import -v -trustcacerts -storepass 123456 -alias server -file D:\abc\d\server-cert.cer -keystore D:\abc\d\server.jks

passwordless key command:
openssl rsa -in client-key.key -out client-key.key.unsecure