Generating the Server Certificate
Now we need to generate the server certificate:
root# openssl req -new -nodes -keyout newreq.pem -out newreq.pem
Generating a 1024 bit RSA private key
writing new private key to 'newreq.pem'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [Some-State]:NSW
Locality Name (eg, city) :Sydney
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas
Organizational Unit Name (eg, section) :IT
Common Name (eg, YOUR name) :ldap.abmas.biz
Email Address :[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password :
An optional company name :
Again, there are some things to note here.
enter a password.
Common Name (CN)
the fully qualified domain name (FQDN) of your ldap server.
Now we sign the certificate with the new CA:
root# /usr/share/ssl/misc/CA.pl -sign
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Serial Number: 1 (0x1)
Not Before: Mar 6 18:22:26 2005 EDT
Not After : Mar 6 18:22:26 2006 EDT
countryName = AU
stateOrProvinceName = NSW
localityName = Sydney
organizationName = Abmas
organizationalUnitName = IT
commonName = ldap.abmas.biz
emailAddress = [email protected]
X509v3 Basic Constraints:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
X509v3 Authority Key Identifier:
Certificate is to be certified until Mar 6 18:22:26 2006 EDT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem
That completes the server certificate generation.