5.5 Create a CA Certificate and Key

The following command can be used to create a CA certificate that is valid for 10 years:

$ openssl req -x509 -newkey rsa:4096 -keyout cacert.key -out cacert.crt -days 3652 -sha256 - config openssl.cnf

This command will prompt for the Distinguished Name fields and will ask for a password to encrypt the private key. Since the configuration file was modified to include most of the Distinguished Name default values, pressing Enter is acceptable for most items. Be sure to enter an appropriate string for the Common Name field. In the following example, the Common Name is Test CA.

Example output from the req command is shown below. Note that the PEM passphrase and Common Name are inputs.

$ openssl req -x509 -newkey rsa:4096 -keyout cacert.key -out cacert.crt -days 3652 -sha256 - config openssl.cnf
.++
.++
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank
For some fields there will be a default value, 
If you enter '.', the field will be left blank.
Country Name (2 letter code) [US]:
State or Province Name (full name) [Arizona]: 
Locality Name (eg, city) [Chandler]:
Organization Name (eg, company) [Microchip Technology]: 
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:Test CA 
Email Address []:

The options used by the “req” command are as follows:

Table 5-1. req Command Options
Option	Description
`-x509`	Creates a self-signed CA certificate instead of a certificate request.
`-newkey rsa:4096`	Creates a 4096-bit RSA private key.
`-keyout cacert.key`	Writes the CA private key to “cacert.key”.
`-out cacert.crt`	Writes the CA certificate to “cacert.crt”.
`-days 3652`	Sets the certificate validity period to 3652 days.
`-sha256`	Uses SHA256 as the signature hash algorithm.
`-config openssl.cnf`	Uses “openssl.cnf” as the configuration file.