Create Certificates Locally using openssl

You can use openssl to locally create certificates suitable for use in a lab environment.

Note

Starting with StarlingX Release r13, the default key type for platform certificates is ECDSA P-384. RSA keys (4096 bits or longer) are also supported.

You can check the key algorithm and length by running openssl x509 -in <the certificate file> -noout -text and looking for Public-Key in the output.

Procedure

1. Create a Root CA Certificate and Key

   1. Create the Root CA private key.

      For ECDSA (recommended):

      $ openssl ecparam -name secp384r1 -genkey -noout -out my-root-ca-key.pem
      

      For RSA:

      $ openssl genrsa -out my-root-ca-key.pem 4096
      

   2. Generate the Root CA x509 certificate.

      $ openssl req -x509 -new -nodes -key my-root-ca-key.pem \
      -days 1024 -out my-root-ca-cert.pem -outform PEM
      

2. Create and Sign a Server Certificate and Key.

   1. Create the Server private key.

      For ECDSA (recommended):

      $ openssl ecparam -name secp384r1 -genkey -noout -out my-server-key.pem
      

      For RSA:

      $ openssl genrsa -out my-server-key.pem 4096
      

   2. Create the Server CSR.

      Specify “CN=registry.local” and do not specify a challenge password.

      $ openssl req -new -key my-server-key.pem -out my-server.csr
      

   3. Create the SANs list.

      $ echo subjectAltName = IP:<WRCP-OAM-Floating-IP>,IP:<WRCP-MGMT-Floating-IP>,DNS:registry.local,DNS:registry.central > extfile.cnf
      

   4. Use the my-root-ca to sign the server certificate.

      $ openssl x509 -req -in my-server.csr -CA my-root-ca-cert.pem \
      -CAkey my-root-ca-key.pem -CAcreateserial -out my-server-cert.pem \
      -days 365 -extfile extfile.cnf
      

   5. Put the server certificate and key into a single file.

      $ cat my-server-cert.pem my-server-key.pem > my-server.pem