Start XCA

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 1

Create a new database

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 2

Name and save your database

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 3

Select a password - you will need this every time you reopen

this database

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 4

Generate a new private key for the root CA

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 5

Name it something like s3c3_root - we are using 4098 bits for

the example

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 6

Your shiny new key

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 7

Create a new self-signed certificate

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 8

Make sure the selected template is CA and click on Apply

extensions

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 9

Fill out the subject and click on Generate a new key

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 16

Set the name of the server (server1 in this example) and add

_client to the name - use a 2048 bit key or larger

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 17

Make sure to also select Non Repudiation in the Key usage

pane and click OK

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 18

In the Certificates pane, click on New Certificate

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 19

Check Sign this request, uncheck copy extensions, make sure

to check "Use this Certificate for signing" and use your root,

select HTTPS_client in templates and click Apply all

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 20

Make sure Non Repudiation is also selected and click on OK

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 21

Generating a server certificate is the same as a client, except

you will use the HTTPS_server template

Note that you WILL need to choose "Use this Certificate for signing" and select your root key. I forgot

to while building the screenshots and had to rebuild this certificate.

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 22

X Certificate and Key management

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 23

Export the keys for server 1, the private server key ...

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 24

... which should be named servername.pem (server1.pem for

our example server1)

Generating, signing and exporting keys and certificates with XCA

Generating, signing and exporting keys and certificates with XCA Page 25