How to create a Windows localhost certificate based on a local CA?

Question

In my attempts to understand how TLS certificates work on Windows, I haven't found a simple and comprehensive guide, but I've accomplished some necessary steps.

First, I succeeded in downloading the OpenSSL command as OpenSSL Light Stable from slproweb.com/products/Win32OpenSSL.html . Brief descriptions of the subcommands are at https://www.openssl.org/docs/man1.1.0/apps/ . I added the OpenSSL bin folder to System > Properties > Advanced > Environment Variables > System Variables > Path, so the command "OpenSSL" would work in an Admin Command Prompt window.

Next, I learned how to create a Certificate Authority (CA) for local use at deliciousbrains.com/ssl-certificate-authority-for-local-https-development/ . This resulted in storing a created .CRT file in the machine storage location "Trusted Root Certification Authorities", which is used by local browsers when accessing HTTPS Web pages. This new CA certificate can be seen in Computer Management Console > Certificates (which might have to be added as a new MMC Snap-In) or View Certificates somewhere in the Options in any browser or by using the very useful certutil Windows command.

The specific commands used in an Admin Command Prompt (%windir%\system32\cmd.exe) for creating a local CA were:

1. Choose a secret pass phrase and provide it whenever asked.
2. Generate private key: openssl genrsa -des3 -out CA_NAME.key 2048
3. Generate PEM certificate from the private key: openssl req -x509 -new -nodes -key CA_NAME.key -sha256 -days 1825 -out CA_NAME.pem
4. Create root CA certificate: openssl x509 -outform der -in CA_NAME.pem -out CA_NAME.crt
5. Install CA root certificate on local computer: Right-click CA_NAME.crt, choose Install Certificate Certificate Import Wizard > Local Machine > Browse... > Trusted Root Certification Authorities

Note: it is not clear to me which of these pass phrases and generated files will ever be needed again, and for what purposes. Clearly, the stored CA certificate will be used as the root for any further more specific certificates on the current computer.

Next, the question I ask here is how to create a server authorization certificate for one or more websites in the localhost domain (examples: localhost/MY_WEBSITE, localhost/FOLDER/FILE.html) based on the newly installed trusted CA certificate. This would permit using browser URLs such as https://localhost/MY_WEBSITE without errors, assuming the local server listens for such secure Web requests.

I have found several algorithms, but they all appear to be either obsolete or incomplete. It is clear that part of this algorithm must be the creation of a "SAN" file that contains the list of websites that will be authorized, and that another part must be a Certificate Signing Request (CSR).

Can someone please provide such an algorithm, a list of steps like the list above, for creating and installing a localhost website certificate based on an existing local CA certificate, created as above? Please be sure to test what you propose before answering.

Answer 1

OpenSSL doesn't require an admin terminal.

...It is not clear to me which of these pass phrases and generated files will ever be needed again, and for what purposes.

• CA / ICA passphrase is utilized whenever signing new certs, as the CA / ICA should always have an encrypted key
• Server certificates should never have an encrypted key, as it then requires manual intervention to start
• Client certificates with an encrypted key would request the passphrase whenever the certificate is utilized.

...Next, the question I ask here is how to create a server authorization certificate for one or more websites in the localhost domain

This is accomplished through SAN profiles.

• The default openssl.cnf from OpenSSL is quite difficult to parse for anyone not familiar one, so I created a custom, easy to understand openssl.cnf a few years ago on my GitHub
  • Line 164: SAN profiles begin
  • Line 260: V3 Profiles begin
  • Line 430: All required commands and information begin

...Can someone please provide such an algorithm, a list of steps like the list above, for creating and installing a localhost website certificate based on an existing local CA certificate, created as above?

To keep things sane, I'll be using V3 profiles contained within my linked openssl.cnf above

1. Create Required Directories:

   mkdir ca\csr certs crl keys
   

2. Create Required Files:

   echo 00 > crl\crlnumber && type NUL > index && type NUL > rand && echo 00 > serial
   

3. Create CA

   openssl req -x509 -new -sha512 -days 3650 -newkey rsa:4096 -keyout ca\ca.key.pem -out ca\ca.crt.pem -config .\openssl.cnf -extensions v3_ca
   

   • CA Key Passphrases: 20 character minimum, containing 2: uppercase, lowercase, numbers, & symbols

     4. Generate Server Cert CSR:

        openssl req -out ca\csr\server.csr -new -days 3650 -sha512 -newkey rsa:2048 -keyout keys\server.key.pem -config .\openssl.cnf -extensions v3_sophos -nodes
        

     5. Create and Sign cert with CA:

        openssl x509 -req -sha512 -days 3650 -in ca\csr\server.csr -CA ca\ca.crt.pem -CAkey ca\ca.key.pem -CAserial .\serial -out certs\server.crt.pem -extfile .\openssl.cnf -extensions v3_sophos
        

     6. Concatenate CA to Cert:

        type ca/ca.crt.pem >> certs/server.crt.pem
        

     7. Export to PKCS12:

        openssl pkcs12 -export -out certs\server.p12 -inkey certs\server.key.pem -in certs\server.crt.pem -certfile ca\ca.crt.pem
        

Additional Information

• Index File
• keyUsage & extendedKeyUsage
  • Definitions
  • KUs
  • EKUs
• Key Exchange and EC Key Exchange
  • KEXs
  • EC-KEXs
• Manuals