Creating self-signed SSL certificates

Create a self-signed SSL certificate using openssl:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out certificate.pem -days 365 -nodes

OpenSSL will ask for Country Name, State or Province Name, Common Name and all that jazz before creating key and certificate.

Create a self-signed SSL certificate using python with the cryptography package:

#! /usr/bin/env python3

from cryptography import x509
 from cryptography.x509.oid import NameOID
 from cryptography.hazmat.primitives import serialization, hashes
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.backends import default_backend
 import datetime

name_attributes = []

country_name = input("COUNTRY_NAME: ")
 if(country_name != ""):
 name_attributes.append(x509.NameAttribute(NameOID.COUNTRY_NAME, country_name))

state_or_province_name = input("STATE_OR_PROVINCE_NAME: ")
 if(state_or_province_name != ""):
 name_attributes.append(x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, state_or_province_name))

locality_name = input("LOCALITY_NAME: ")
 if(locality_name != ""):
 name_attributes.append(x509.NameAttribute(NameOID.LOCALITY_NAME, locality_name))

organization_name = input("ORGANIZATION_NAME: ")
 if(organization_name != ""):
 name_attributes.append(x509.NameAttribute(NameOID.ORGANIZATION_NAME, organization_name))

common_name = input("COMMON_NAME: ")
 if(common_name != ""):
 name_attributes.append(x509.NameAttribute(NameOID.COMMON_NAME, common_name))

print("Enter SubjectAltName DNSName values, one at a time. Press Enter on an empty line to finish.")
 san_list = []
 san = "nonempty"
 while san != "":
 san = input("SAN DNSName: ")
 if san != "":
 san_list.append(x509.DNSName(san))

# Generate our key
 key = rsa.generate_private_key(
 public_exponent=65537,
 key_size=2048,
 backend=default_backend()
 )

# Write our key to disk for safe keeping
 with open("key.pem", "wb") as f:
 f.write(key.private_bytes(
 encoding=serialization.Encoding.PEM,
 format=serialization.PrivateFormat.TraditionalOpenSSL,
 encryption_algorithm=serialization.NoEncryption(),
 ))

# Various details about who we are. For a self-signed certificate the
 # subject and issuer are always the same.
 subject = issuer = x509.Name(name_attributes)

cert = x509.CertificateBuilder().subject_name(
 subject
 ).issuer_name(
 issuer
 ).public_key(
 key.public_key()
 ).serial_number(
 x509.random_serial_number()
 ).not_valid_before(
 datetime.datetime.utcnow()
 ).not_valid_after(
 # Our certificate will be valid for 365 days
 datetime.datetime.utcnow() + datetime.timedelta(days=365)
 )

# add SAN entries if any have been entered
 if san_list:
 cert = cert.add_extension(
 x509.SubjectAlternativeName(san_list),
 critical=False
 )

# Sign our certificate with our private key
 cert = cert.sign(key, hashes.SHA256(), default_backend())

# Write our certificate out to disk.
 with open("certificate.pem", "wb") as f:
 f.write(cert.public_bytes(serialization.Encoding.PEM))

The script will ask for Country Name, State or Province Name, Common Name and all that jazz before creating key and certificate. We even get to enter SubjectAlternativeName values! Great.

Leave a Reply Cancel Reply