How to create a self-signed certificate using OpenSSL
Note: If you use a Certificate Authority (CA) such as VeriSign, follow their instructions.
CREATE THE CERTIFICATION AUTHORITY (CA) CERTIFICATE
1. Generate the key for the CA certificate
openssl genrsa -des3 -out ca.key 2048
Enter an appropriate pass phrase.
2. Show the key
openssl rsa -noout -text -in ca.key
3. Compose the CA certificate from the key
openssl req -new -x509 -days 2555 -key ca.key -out ca.crt
Enter a certification authority name in [Common Name] (CN) field.
For example: TEST-CA
4. Show the CA certificate
openssl x509 -noout -text -in ca.crt
CREATE THE SERVER CERTIFICATE
1. Generate the key for the server certificate
openssl genrsa -out server.key 2048
2. Show the key
openssl rsa -noout -text -in server.key
3. Compose the server certificate from the key
openssl req -new -key server.key -out server.csr
Enter a Brekeke SIP Server machine IP address or FQDN in [Common Name] (CN) field.
For example: 172.16.14.11
Note: Common Name (CN) must be different from the Certificate Authority (CA)’s CN.
4. Sign the server certificate with the CA certificate
openssl x509 -days 365 -CA ca.crt -CAkey ca.key -req -CAcreateserial -CAserial ca.srl -in server.csr -out server.crt
5. Show the server certificate
openssl x509 -noout -text -in server.crt