Void And Any

cd && mkdir -p myCA/certs && mkdir myCA/private && mkdir myCA/csr && mkdir myCA/newcerts && mkdir myCA/crl && mkdir myCA/tmp && cd myCA
echo '01' > serial  && touch index.txt
cp /etc/ssl/openssl.cnf .

dir        = <strong>/home/[utilisateur]/myCA</strong>            # Where everything is kept
certs        = $dir/certs        # Where the issued certs are kept
crl_dir        = $dir/crl        # Where the issued crl are kept
database    = $dir/index.txt    # database index file.
new_certs_dir    = $dir/newcerts        # default place for new certs.
certificate    = $certs/cacert.pem    # The CA certificate
serial        = $dir/serial         # The current serial number
crl        = $dir/crl.pem         # The current CRL
private_key    = $dir/private/cakey.pem # The private key
RANDFILE    = $dir/private/.rand    # private random number file

default_days    = 1825            # how long to certify for
default_crl_days= 30            # how long before next CRL
default_md    = sha1            # which md to use.

[ req_distinguished_name ]
 countryName                     = Pays (2 lettres)
 countryName_default             = FR
 countryName_min                 = 2
 countryName_max                 = 2
 stateOrProvinceName             = Region
 stateOrProvinceName_default     = PAYS DE LOIRE
 localityName                    = Ville
 localityName_default            = Nantes
 0.organizationName              = Societe
 0.organizationName_default      = VoidAndAny
 #organizationalUnitName         = Organizational Unit Name (eg, section)
 #organizationalUnitName_default =
 commonName                      = Site
 commonName_max                  = 64
 emailAddress                    = Email
 emailAddress_max                = 64
 emailAddress_default            = mon_email@free.fr

Pays (2 lettres) [FR]:
Region [PAYS DE LOIRE]:
Ville [Nantes]:
Societe [VoidAndAny]:
Site []: mon_domaine.fr
Email [mon_email@free.fr]:

nsComment            = "Void And Any Generated Certificate"

openssl req -new -x509 -config ./openssl.cnf -keyout ./private/cakey.pem -out ./certs/cacert.pem -days 1825

openssl req -new -keyout ./private/mondomaine.key -out ./csr/mondomaine.csr -config ./openssl.cnf -nodes -days 1825

Generating a 2048 bit RSA private key
 .............+++
 ............................+++
 writing new private key to '/etc/nginx/certificates/test.key'
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [AU]:FR
 State or Province Name (full name) [Some-State]:PAYS DE LOIRE
 Locality Name (eg, city) []:Nantes
 Organization Name (eg, company) [Internet Widgits Pty Ltd]:VoidAndAny
 Organizational Unit Name (eg, section) []:
 Common Name (eg, YOUR name) []:mon_domaine.fr
 Email Address []:mon_email@free.fr

openssl ca -infiles ./csr/mondomaine.csr -out ./certs/mondomaine.crt -config ./openssl.cnf

mkdir -p ~/myCA && cd ~/myCA
wget http://guiguiabloc.appspot.com/wp-content/2008/12/easyca.tgz
tar -xvf easyca.tgz
mv easyca/* .
chmod 755 easyCA.sh

# !!!!! remove this line after configuration as it is NOT_CONFIGURED yet !!!

=====================================================================
 Certificate Management System
 easyCA version 0.9(6) by Ferry Kemps and Guiguiabloc
 GPL Licensed
 =====================================================================
 
 1) Sign a Certificate Signing Request (PKCS#10)
 2) Create a Server Certificate (PEM SelfSigned)
 3) Create a Client Certificate (PKCS#12)
 4) Create a Certificate Signing Request
 5) Generate Certificate Revocation List (CRL)
 6) List, Display and Revoke Certificates
 
 I) Initialize Root Certificate Authority (CA)
 O) Initialize OCSP Server Certificate
 B) Backup & Restore the Certificate environment
 R) Reinstall easyCA (erase)
 
==> Make your choice [none]:

-----------------------------------------------------------------------
 ----------------- Initialize root Certificate Authority ---------------
 -----------------------------------------------------------------------
 
Are you sure you want to (re)initialize the Root CA? [y|n]: y
 >>> Initializing Root CA <<<
 Generating a 1024 bit RSA private key
 ...................++++++
 .............................................++++++
 writing new private key to './private/cakey.pem'
 Enter PEM pass phrase:
 Verifying - Enter PEM pass phrase:
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [NL]:
 State or Province Name (full name) [Gelderland]:
 Locality Name (eg, city) [Arnhem]:
 Organization Name (eg, company) [Your Company Name]:
 Organizational Unit Name (eg, section) [HQ]:
 Common Name (eg, your name or your server's hostname) []:
 Email Address [postmaster@domain.ext]:
 
Press [enter] to continue

-----------------------------------------------------------------------
 --------------- Generate Certificate Signing Request ------------------
 -----------------------------------------------------------------------
 
Enter Certificate CN (Common name|FQDN) like www.example.com [none]: mondomaine
 Generating a 1024 bit RSA private key
 ..................++++++
 .......++++++
 writing new private key to './private/mondomaine-key.pem'
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [NL]:
 State or Province Name (full name) [Gelderland]:
 Locality Name (eg, city) [Arnhem]:
 Organization Name (eg, company) [Your Company Name]:
 Organizational Unit Name (eg, section) [HQ]:
 Common Name (eg, your name or your server's hostname) []:mondomaine.fr
 Email Address [postmaster@domain.ext]:
 
Please enter the following 'extra' attributes
 to be sent with your certificate request
 A challenge password []:
 An optional company name []:
 
Certificate Signing Request (CSR) stored as: ./csr/mondomaine.csr
 Certificate private-key stored as: ./private/mondomaine-key.pem
 Press [enter] to continue

-----------------------------------------------------------------------
 --------------- Certifiace Signing Request handling -------------------
 -----------------------------------------------------------------------
 
(CSR request files should be copied into directory: ./csr)
 
1: mondomaine.csr
 
==> Select the CSR to sign [none]: 1
 
==> Add OCSP Extension to Certificate ? [y/N]: N
 
==> Select the Usage Key [server|client|none]: server
 Using configuration from ./openssl.cnf
 Enter pass phrase for ./private/cakey.pem:
 Check that the request matches the signature
 Signature ok
 Certificate Details:
 Serial Number: 1 (0x1)
 
...
 
 Certificate is to be certified until Jun 19 18:36:00 2016 GMT (1825 days)
 Sign the certificate? [y/n]:y
 
1 out of 1 certificate requests certified, commit? [y/n]y
 Write out database with 1 new entries
 Data Base Updated
 
Signed certificate stored as: ./certs/mondomaine.crt
 Return this certificate to the requesting party.
 
Display Certificate? y/n [n] n

openssl req -new -x509 -config ./openssl.cnf -keyout ./private/cakey.pem -out ./certs/cacert.pem -days 1825
 
openssl req -new -nodes -config ./openssl.cnf -days 1825 -keyout ./private/mondomaine-key.pem -out ./csr/mondomaine.csr
 
openssl ca -config ./openssl.cnf -cert ./certs/cacert.pem -extensions  SERVEUR -in ./csr/mondomaine.csr -out ./certs/mondomaine.crt

cd ~
sudo cp myCA/certs/mondomaine.crt /etc/nginx/certificates
sudo cp myCA/private/mondomaine-key.pem /etc/nginx/certificates
sudo chown root.root /etc/nginx/certificates/mondomaine-key.pem
sudo chmod 400 /etc/nginx/certificates/mondomaine-key.pem