Create & sign SSL/TLS certificates with openssl

In this video, we will learn how to generate a SSL/TLS certificate signing request (CSR) and have it signed by a Certificate Authority (CA). For the purpose of this tutorial, we won’t submit the CSR to a real CA. Instead, we will play both roles: the certificate authority and the certificate applicant.

We will use openssl to do following things:
1. Generate a private key and self-signed certificate of the Certificate Authority (CA).
2. Generate a private key and certificate signing request (CSR) for our web server.
3. Use the CA's private key to sign our web server's CSR and get back the signed certificate.
4. Verify if a certificate is valid or not.

---

Credit:
- Desktop wallpaper is a photo by Scott Taylor on Unsplash:

[aniket-kulkarni]

Man, I even took a 3 hour Pluralsight course on this. But none were as good as yours. You're just incredibly awesome.

[sudeepagrawal]

This is simply excellent and exactly what I have been looking for weeks in the past.
Thanks bud.

[R]

Beauty.... Thank you so much.. I was trying to setup self signed certs in my controlled environemt and i was always confused about all this. You made it very simple... Awesome

[NamitKewat]

Thank you for the tutorial.
I really enjoyed watching both videos(this & SSL/TLS overview).

[VisualMemoryBlue]

Your tutorial was so helpful, especially for the Subject Alternative Name Section in the Certificates. Thanks a ton, you rock!!

[davesradiorepairs]

WOW...!!! To actually see some of these commands used, and how they is priceless... Thank you...!!!
Don't stop now... Hope you'll make more videos explaining some of the options for various commands..

[sushillakra]

Thank you very much, you saved me ton of time understanding openssl to create self signed certificate.

[vs-cwwc]

I wish every tech video on Youtube is like this.

[roberto_camp]

badass job! one of the best SSL videos I've ever watched!

[christianthomas]

Great video and explanation. Is there a way to change the notBefore date? I want to rotate certs and need to create certs that have start dates in the future and not at the time of creation, so just wondering if there's a way to change the startdate or notBefore date, thanks.

[gedeonandrasmusic]

Amazing tutorial, thank you very much!

[shmulick]

Thank you so much
That was exactly what I was looking for !!!

[tonykososki]

Man that last video was very good! I couldnt understand everything but its a piece of good kowledge!

[rahulchitta]

This is brilliant work! Thank you so much for this. :)

[electrotsmishar]

man, that was a wonderful explanation. good job

[iamgentwo]

Excellent! tried on linux and Chrome / Firefox recognize the ca-cert-pem without any issues, but it didn't work on Windows (Chrome /internet explorer). is there any conversion need to be done?

[baloguntobi]

Hey bro. Help me with this question: With tls you can still read the email and secret (maybe password) sent from the client to the server in the network tab so what exactly is being encrypted?

[samanthaletourneau]

I followed your video to generate the files for using haproxy with SSL. I got all the files exactly as you did and I ran openssl verify -CAfile ca-cert.pem server-cert.pem which says server-cert.pem: OK. In order to make haproxy with SSL to work, I need to have only one .pem file which contains the private key, the certificate and the chain values. Can you tell me what content of those files generated need to be used by order of importance in order to create the latest .pem file for haproxy ? Thank you

[eduardodasilvaramos]

Você foi simplesmente fantástico! Muito obrigado.

[kiransowpati]

thanks, good session on steps of ssl cert generation