Comments (8)
Hi @aze2201 , CSR has to be signed with the private key same as the private key signs the certificate that csr are being used to create.
can you explain more on what are you trying to do, possibly with openssl cli or in other programming language?
from lua-resty-openssl.
Sure. Here is example command in openssl.
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 360 -extfile filename
As we can see csr generated by different key without signing(server.key
), another root key is signing that csr. Like public CA signing our csr.
In my case ca.key
and ca.crt
exist already. I want using lua to generate csr and sign with these keys, instead of own (self) keys and get server.crt
file
from lua-resty-openssl.
This is actually creating a cert according to the content provided by csr, and sign with the root CA key. You can do the following:
- Verify the CSR has valid signature (by using the subject key to verify the signature inside csr)
- Get the subject name, alt names etc all extensions you care about from the csr.
- Create an empty x509 instance, set the extensions exactly as what provided by csr.
- Set not_before of the x509 to now, not_after to now+valid time.
- Set the issuer_name of x509 to CN of CA
- Set subject key Id to the server.key
- Sign the x509 with root CA
This https://github.com/fffonion/lua-resty-openssl/blob/master/t/openssl/helper.lua#L10 is the example on how to set those stuff in x509.
from lua-resty-openssl.
if you are only looking for "create a x509 cert signed with existing ca", instead of a self signed cert, then csr is not required. Simply use the link i provide in previous comment and pass is_ca
to false.
from lua-resty-openssl.
I think we misunderstand each other. Correct me if I am wrong please. Above link will create signed cert from existing private key. It is like self-signed certificate. But I don't want self-signed.
If so, let me rephrase my question.
We have rootCA and keys already, which not part of web server. root CA should be used on webserver. it is only sign CSR to multiple CN for multiple web domains.
The flow is like that. (same as when we issue new domain https)
- Generate
server.key
- Generate CSR named
server.csr
from thisserver key
. - Send to site where lua-resty-openssl
- lua-reasy-openssl will take this
CSR
and sign with own existingCA
andCAkey
and outputserver.crt
to issuer. - Then we can install
server.key
andserver.crt
on our NGINX or Apache.
So I want to use existing key pair to sign another any CSR.
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 360
Do you think are we in same page about my question?
from lua-resty-openssl.
@aze2201 Yes we are on the same page : )
If you want to use lua-resty-openssl to act like a CA service then yes you will need CSR indeed. Please use #118 (comment) this comment as guide. Note you are creating a new x509 cert, with all stuff from CSR, instead of "signing a CSR".
(I know some KB docd use "sign CSR" to refer to this process, but it's inaccurate in our context. We have csr:sign()
which signs the content of CSR. And it's not what you are looking for.)
from lua-resty-openssl.
you can also refer to openssl src https://github.com/openssl/openssl/blob/master/apps/x509.c, only note all branches with if reqfile
. and you can reimplement with our lua binding to the matching C function.
from lua-resty-openssl.
closing for inactivity, please re-open if needed
from lua-resty-openssl.
Related Issues (20)
- about the return value of store:verify HOT 2
- It's better not bind `X509_STORE_set_flags` logic in `store:add(crl)` HOT 4
- Wrong parameter in dump_jwk used HOT 1
- How does it work for rsa pss sign or verify ? HOT 3
- x509:get_extension("subjectKeyIdentifier"):text() is in weird format HOT 6
- Read custom X509 extension HOT 12
- API change in OpenSSL 3.x
- Makefile doesn't installs all files HOT 1
- module 'resty.openssl.include.x509' not found HOT 2
- nginx using boringssl start failed HOT 8
- Regression since release 0.8.0 HOT 10
- Dependency to git for installation of version 0.8.2-1 HOT 2
- lua-resty-openssl not work for latest nginx-1.21.X version HOT 2
- Symbol not found: sk_pop_free HOT 4
- BoringSSL not working HOT 1
- Is lua-resty-openssl-aux-module still required to run lua-resty-openssl in production? HOT 3
- Crash when signature with invalid JWK is attempted HOT 4
- Hot to get fingerprint? HOT 5
- 尝试解密微信支付AEAD_AES_256_GCM的加密文本遇到错误:cipher:final: EVP_CipherFinal_ex failed HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lua-resty-openssl.