In this lesson, we'll take a look at SSL certificates,
what they are used for and how we can create and inspect them.
But first a clarification,
what we called SSL in the past is nowadays actually TLS,
but they're often still referenced with the old name that doesn't apply anymore.
Let's explore the terminology.
So SSL stands for secure sockets layer
and TLS stands for transport layer security.
So why do we still use the wrong old name
because SSL was used for a very long time and
the name kind of stuck around in various tools and documentation
even after most certificates migrated to TLS.
So why do we still use the wrong old name
because SSL was used for a very long time and
the name kind of stuck around in various tools and documentation
even after most certificates migrated TLS.
Now we can think of TLS as an upgrade over SSL.
SSL had many security issues and TLS closed a lot of those security holes.
Now with this clarification out of the way, let's get to our next topic.
What are these certificates used for?
What are SSL certificates?
Well,
let's think about what happens when we use a password
on a website or when we enter credit card details or
anything like that.
There are two big problems. One,
how can we be sure that we are sending this data to
the legitimate website and not some clone created by a malicious hacker.
And two,
how can we be sure that no one can steal
these details as they're being sent through the networks?
Well, certificates solve both of these issues.
They authenticate the website
and they encrypt network traffic between the user and the website
authentication means that the website can cryptographically
prove that a browser is legitimate.
It proves it's actually code cloud.com and not some clone.
And the certificate is used also to make the
connection private between the user and code cloud.com.
All data exchanged within the website is encrypted.
Now, let's see how we can actually create such certificates.
Now,
the utility that's normally used on Linux to
create managed TLS certificates is called OpenSSL.
And we can already notice an area where the old SSL name
is still hanging around from the old days while it's called OpenSSL,
we'll actually create TLS certificates with it.
If we consult the manual of OpenSSL with the man OpenSSL command,
we'll see that the documentation points out.
The utility can be used for a lot more than just certificates.
It can deal with many Cryptography related operations.
But what interests us in this lesson is the creation of X 0.509 certificates.
These are the certificates that we can use on websites
to do the authentication and encryption that we mentioned before.
Unfortunately,
the OpenSSL command supports a very large number of subcommands and options
and it could be hard to remember what we actually need to type in for a specific task.
But the good thing is we can use a few tricks to orient ourselves.
Let's learn how to do that right on the command-line.
First, to get an idea about the subcommands supported, we can type
openssl
oh
or simply
OpenSSL.
This will display the following output.
Let's pay attention to the first section titled standard commands.
Notice the wreck
and X 509 subcommands. These will be the focus of our lesson.
Now since openssl is a complex tool, it has multiple manuals,
one manual for every important subcommand that we see here
to see the manuals available. We can type in man,
OpenSSL and press tab twice.
And we'll see this.
If we want to inspect the rex subcommand, we can type in man
OpenSSL
rec.
Another way we can do this is man OpenSSL dash R
and it will show us the same thing.
We'll see that commands to generate certificates
can get quite complex as a beginner.
It can be quite hard to get started just by
looking at this manual and all these options that the R
subcommand supports.
However, we can get a few very useful tips here. If we press slash
and type in example, in all capital letters,
it'll help us find the example section where we can learn how to get started.
Note these two commands here as we'll actually adapt these in our demonstration
to generate a certificate signing request and create a self signed certificate.
Now, let's press Q to quit this manual.
The same procedure can be followed to examine the openssl X 509 commands.
Let's quickly explore certificate signing requests.
The R
subcommand deals with certificate signing requests.
That's because the digital certificates used to secure
website traffic are not enough on their own.
Example.com can use a certificate to secure web traffic between a user and a website
that's no issue.
But when a user visits example.com,
their browser also needs to trust the certificate.
It needs a way to be sure that the certificate is legitimate,
the real deal and not some fake created by a malicious hacker.
So how can it be sure
by checking if something called a certificate,
authority signed example.com certificate,
so we can send our certificate that we generate locally to some company like Google,
then they use a special private key and sign our certificate.
Once that certificate is signed,
any browser can then check the signature and notice
that indeed Google validated it so it's legitimate.
And now let's see how to generate two things.
A private key and the certificate signing request
certificates are normally used in conjunction with such a secret key,
we'll generate both of these things with a single command.
The one we actually saw on Emanuel earlier
dash new key,
RS A colon 2048 is the option that lets
us instruct OpenSSL to generate a key of this type
RS A on 2048 bits
dash key out key dot pim tells the utility to save
the private key in a file called key dot pe M
and dash out
RQ dot pe saves our certificate signing, request the CS R to a file called Rec dot Pim.
Now we'll get a few questions.
First, we have to pick a password to protect and encrypt our private key file.
Next, we'll be asked a few details which will be included in the signing request.
We're basically telling the certificate authority what we want to sign a
certificate for a company called code cloud
with its location in New York and so on.
We'll explain these properties in our next example,
ok?
And we'll see that they were created.
And if we type in cat, he dot P,
we can see the content of the key file.
It's base64 encoded, so it won't make any sense.
But at least the first and last lines tell us
that this is a private key and it's encrypted.
If we type in
CREQ dot pe M for re,
we can also see the base64 encoded CS R we generated.
So it's useful that if we look at these files, we can at least know what they represent
in the real world. We would send the CS R file to a certificate authority.
They would check and verify our details.
We would prove our identity, pay a fee and get a certificate.
Here's how we can generate a self signed certificate.
When we want the whole world to be able to validate and trust our certificate.
We need the services of a certificate authority.
But other scenarios exist.
For example,
we might only want to use the certificate internally in our office network
and we can configure all the computers to trust all of our local certificates. In
this case, we can do what's called self signing a certificate.
So we can skip generating a CS R and sending it to an authority.
We can generate the final signed certificate ourselves
to generate our self signed TLS certificate.
We'll use a few extra options in the command
just to show an example of how we can further customize our certificate.
These are the options. We'll use dash X 5 0 9 dash no A and C
new key RS A 4096 days 365 key out my private
dot key and dash out my certificate dot C RT.
Now let's take a look at what all of these mean
dash X 509 tells the command to generate an X 0.509 type of certificate
instead of creating a certificate, signing request,
OpenSSL REQ on its own.
Without this option would simply create a request and not generate the certificate
dash no enc tells OpenSSL not to ask us for a password to encrypt this key.
In a real scenario. This isn't recommended.
But for experimental purposes, we don't need a password
dash,
new key RS A colon 4096 tells OpenSSL to use the RS
A algorithm for this key and use 4096 bits for it.
The current default is RS A 2048.
But we wanted to show you how you can pick a different algorithm or a bit number.
If you need to
dash days,
365 makes a certificate valid for 365 days after which it's considered expired
dash key out.
My private dot key saves the private key to a file called my private dot key.
Dash out my certificate dot C RT
saves the certificate to a file named my certificate dot C RT.
In conclusion to sign and create our certificate in one go. We use this command
after the command generates some cryptographic secrets. We get a few prompts.
Now let's explain these prompts as promised.
Now,
if we press enter the default choice shown between square brackets will be picked.
For example, at the first prompt here.
If we press enter, then A U will be picked as a country code.
But if we want to pick the United States instead, we would type us here.
Same goes for all the other prompts
for a website. The organization name and common name are important.
The organization name can be the name of the company and
the common name should include the address of our website.
For example, code cloud.com,
all of these values will be stored in a certificate,
but they will usually be abbreviated when we display the content of a certificate.
For example, CN will stand for common name
on for organization name and ou for organizational unit.
In fact,
if we try to take a look at the text file itself like we did before with cat
my certificate, that cat,
we will see the same base64 encoded content.
But this time, there's an important difference.
It now mentions that this is actually a certificate,
not a certificate request.
So we finally have our self signed final certificate.
But how can we check details about it since this encoded text is not very helpful
since we are dealing with an already existing certificate.
This time, we can use the X 509 subcommand.
Since its purpose is to interact with X 509 certificates,
we can get a little bit of help about the
X 509 command by throwing in the dash help option.
It seems that
text will make the command, print the certificate in text form.
That sounds like what we need.
The next option we need to throw in is the dash in
option which tells OpenSSL what input file it should look at.
So we'll type in openssl
X 5 0 9 dash N
my certificate dot
CRT
and then
text.
This will output a lot of text. But if we scroll back up,
we'll see the details that interest us.
C which stands for country code is us.
The state is Oregon,
L meaning location is Gaston
O short for organization is code cloud
and CN
which is a common name is code cloud.com.
And if I would have put an email address that would have shown at the end,
there are a few extra details that might interest
us such as the expiration date under validity.
Not before,
usually indicates when the certificate was issued and
not after is when it will expire.
It can be a bit confusing the first few times about how to use the OpenSSL command,
especially when to use the R subcommand and when to use the X 509 subcommand.
But you can think about it this way to serve as a quick reminder.
If I need a certificate,
I need to request something.
So I use the rec subcommand.
For example,
if I need to work with an already existing certificate,
what type of certificate is this?
Hmm It was X dot something but I forgot,
let me get a quick reminder about the subcommand supported with
openssl help.
Ah There it is X 509.
So I need an X 509 subcommand,
which means I can use a command like this to get some details about the certificate.
Great.
And remember there's always
man OpenSSL Wreck
and man OPENSSL X 509.
And those will help you out, especially in the examples section.
We hope these mental tricks will aid you in your future OpenSSL tasks.
Now let's move on to our next lesson.