Lesson 1.5: Issuing a certificate from an internal CA
Public websites get certificates from public CAs; internal services (APIs, databases, VPNs, device fleets) usually use an organisation's own CA: a root kept offline and an issuing CA that signs everyday certificates. Doing it by hand teaches what automation does for you: a private key that never leaves the server, a certificate signing request that names the service, and a signature from the issuing CA with the right extensions. In the lab you inspect Northwind's issuing CA, create a key and CSR for the API, discover why the first certificate is useless to browsers, and issue it properly.
17 min
You will learn to
- Explain root and issuing CAs
- Generate a private key with openssl genpkey
- Create a CSR with Subject Alternative Names
- Sign a CSR with the right extensions
- Verify a certificate against its chain
Key terms
- Root CA / issuing CA
- The trust anchor, kept offline / the CA that signs everyday certificates, itself signed by the root.
- CSR
- Certificate Signing Request: public key, subject and requested extensions, signed by the private key.
- Subject Alternative Name (SAN)
- The extension listing the DNS names (or IPs) a certificate is valid for.
- Basic Constraints
- CA:TRUE/FALSE and pathlen: may this certificate sign others, and how deep?
- Extended Key Usage
- What the key may be used for: serverAuth, clientAuth, codeSigning …
- ECDSA P-256
- Elliptic-curve signatures on the NIST P-256 curve: small keys, fast, widely supported.
← Encoding, encryption and hashing · All lessons · CVE, CVSS, CWE and the KEV catalog →