NDC & PKI

[Day 10] 1. PKI Lab using OpenSSL in CLI

D
DITISS Admin
••16 min read

Lab Objective:

  1. Set up your own Certificate Authority (CA) using OpenSSL command-line tools.
  2. Configure an HTTPS website using certificates generated by the CA.

Prerequisite:

Ensure your DNS is properly configured and functional (set it up yourself).

Machine Structure:

plaintext
- shuhari.local/
	- rootca.shuhari.local (192.168.100.51) -> Root CA
	- subca.shuhari.local (192.168.100.52) -> Subordinate CA
	- deb3.shuhari.local (www.shuhari.local) (192.168.100.53) -> Web server
  • Install 
    openssl
     on all three machines.
  • Configure DNS for name resolution.

Note: OpenSSL is an open-source library, similar to XCA.

Steps to Follow:

1. Install Required Packages on All Machines:

Run the following command on all three machines to install OpenSSL and Tree:

bash
sudo apt-get install -y openssl tree vim

2. Verify DNS Configuration:

Use 

nslookup
to test DNS resolution. Check for the following entries:

plaintext
rootca.shuhari.local
subca.shuhari.local
deb3.shuhari.local
www.shuhari.local
rootca
subca
deb3
www
  • Ensure all entries return correct results.

Exam Tip: You may be asked to configure reverse DNS lookup, so set it up here as well.

3. Verify Hostname Commands:

Run these commands and ensure they work as expected:

bash
hostname
hostname -f
hostname -s
hostname -d

4. Create the File Structure:

Perform these steps in 

Root CA
machine:

  1. Create a folder for the CA and required subdirectories:

    bash
    mkdir -p /home/shuhari/ca
cd /home/shuhari/ca
mkdir -p certs crl newcerts private subca/csr subca/certs
tree ca

  2. Secure the 

    private
    folder, as it will store private keys:

    bash
    chmod 700 private/
    • Folder Purpose: 
      • certs
        : Stores certificates.
      • crl
        : Contains the Certificate Revocation List.
      • newcerts
        : Stores new certificates.

5. Create the CA Database:

While in the 

ca
folder, run the following commands to set up the database files:

bash
touch index.txt
touch index.txt.attr
echo 1000 > serial
echo 1000 > crlnumber
  • Files Created: 
    • index.txt
      : Tracks issued certificates.
    • index.txt.attr
      : Additional attributes for the database.
    • serial
      : Stores the next certificate serial number (starting with 1000).
    • crlnumber
      : Tracks the CRL serial number.

6. Configure 
rootca.cnf
:

Download the 

rootca.cnf
configuration file into the 
ca
folder. Modify it to use the correct directory path:

bash
vim rootca.cnf
  • Update the 
    dir
    path from 
    /root/ca
    to 
    /home/shuhari/ca
    .

Here’s the next part of your notes, simplified and organized while keeping all details intact:

7. Generate the Private Key

On the Root CA machine, the private key should be stored inside the 

private
folder. Run the following commands inside the 
ca
directory:

bash
openssl genrsa -aes256 -out private/ca.key.pem 4096
chmod 400 private/ca.key.pem
  • Explanation:
    • The private key is generated using the RSA algorithm with AES-256 encryption.
    • Key size: 4096 bits.
    • A password will be required for key generation.
    • The 
      chmod
      command ensures the private key is secured with read-only permissions.

8. Create the Self-Signed Certificate

On the Root CA machine, generate the self-signed certificate:

bash
cd ca
openssl req -config rootca.cnf -key private/ca.key.pem -new -x509 -days 7300 -sha256 -extensions v3_ca -out certs/ca.cert.pem

  • Options:

    • req
      : Requests OpenSSL to create a certificate.
    • -config
      : Specifies the configuration file (
      rootca.cnf
      ).
    • -key
      : Path to the private key.
    • -new
      : Creates a new certificate.
    • -x509
      : Indicates the certificate standard being used.
    • -days
      : Certificate validity period (7300 days = 20 years).
    • -sha256
      : Specifies the hashing algorithm.
    • -extensions
      : Specifies the template being used (
      v3_ca
      ).
    • -out
      : File where the certificate will be saved.

  • Input Required: Fill in the requested details:

    plaintext
    Password: Enter the private key's password.
Country Name: IN
State: MH
Locality Name: Pune
Organization Name: ShuHaRi Labs
Organizational Unit Name: IS
Common Name: ShuHaRi Root CA
Email Address: info@shuhari.local

  • Result: The Root CA is now configured.

9. Set Up the Sub CA Database

On the Sub CA machine, create the required file structure and database files:

bash
mkdir subca
cd subca
mkdir certs crl csr newcerts private
chmod 700 private/
touch index.txt
touch index.txt.attr
echo 1000 > serial
echo 1000 > crlnumber
  • Folder Purpose: 
    • certs
      : Stores issued certificates.
    • crl
      : Contains the Certificate Revocation List.
    • csr
      : Stores Certificate Signing Requests.
    • newcerts
      : Contains newly issued certificates.
    • private
      : Stores private keys (secured with 
      chmod 700
      ).

10. Download the Sub CA Configuration File (
subca.cnf
)

  • Obtain the 

    subca.cnf
    file from the server and place it inside the 
    subca
    folder.

  • Modify the file to use the correct directory path:

    bash
    vim subca.cnf

    Change the 

    dir
    path from 
    /root/subca
    to 
    /home/shuhari/subca
    .

11. Generate the Sub CA Private Key

On the Sub CA machine, generate the private key:

bash
openssl genrsa -aes256 -out private/subca.key.pem 4096
chmod 400 private/subca.key.pem
  • Explanation:
    • The private key is generated using the RSA algorithm with AES-256 encryption.
    • Key size: 4096 bits.
    • A password will be required for key generation.
    • The 
      chmod
      command ensures the private key is secured with read-only permissions.

Here’s the next part of your notes, simplified and organized:

12. Create the Certificate Signing Request (CSR)

On the Sub CA machine, generate a CSR:

bash
openssl req -config subca.cnf -new -sha256 -key private/subca.key.pem -out csr/subca.csr.pem

  • Explanation:

    • req
      : Requests OpenSSL to create a certificate signing request.
    • -config
      : Specifies the configuration file (
      subca.cnf
      ).
    • -new
      : Generates a new CSR.
    • -sha256
      : Uses the SHA-256 hashing algorithm.
    • -key
      : Specifies the private key for signing.
    • -out
      : Specifies the output file for the CSR.

  • Input: Enter the same details used when setting up the Root CA.

13. Export the CSR to Root CA

Copy the CSR file from the Sub CA machine to the Root CA machine:

bash
scp /home/shuhari/subca/csr/subca.csr.pem shuhari@<rootca_ip>:/home/shuhari/ca/subca/csr/

14. Sign the CSR from Root CA

On the Root CA machine, sign the Sub CA CSR to create the certificate:

bash
openssl ca -config rootca.cnf -extensions v3_intermediate_ca -days 3650 -notext -md sha256 -in subca/csr/subca.csr.pem -out subca/certs/subca.cert.pem
  • Explanation: 
    • ca
      : Requests OpenSSL to act as the Certificate Authority.
    • -config
      : Specifies the configuration file (
      rootca.cnf
      ).
    • -extensions
      : Uses the template 
      v3_intermediate_ca
      .
    • -days
      : Specifies the certificate validity period (3650 days = 10 years).
    • -notext
      : Disables additional text output.
    • -md sha256
      : Uses the SHA-256 hashing algorithm.
    • -in
      : Input file (Sub CA CSR).
    • -out
      : Output file (Sub CA certificate).

15. Verify the Changes

On the Root CA machine, check the database files to confirm the CSR was signed:

bash
cat index.txt
cat serial
cat serial.old
cat index.txt.attr

16. Verify the Sub CA Certificate

Check if the generated Sub CA certificate matches the one in 

newcerts
:

bash
md5sum subca/certs/subca.cert.pem newcerts/1000.pem
  • Expected Result: Both should display the same MD5 checksum.

17. Export the Sub CA Certificate Back

Copy the Sub CA certificate from the Root CA machine to the Sub CA machine:

bash
scp /home/shuhari/ca/subca/certs/subca.cert.pem shuhari@<subca_ip>:/home/shuhari/subca/certs/

18. Create the Private Key for Deb3

On the Deb3 machine, generate a private key:

bash
mkdir certs
cd certs
openssl genrsa -out www.shuhari.local.key.pem 2048
  • Explanation:
    • Generates a private key using the RSA algorithm.
    • Key size: 2048 bits.

19. Generate a CSR for Deb3

  1. Download the 

    subca.cnf
    file on the Deb3 machine.

  2. Create a CSR inside the 

    certs
    directory:

    bash
    openssl req -config subca.cnf -key www.shuhari.local.key.pem -new -sha256 -out www.shuhari.local.csr.pem
  • Input: Provide the required details, altering these: 
    • Common Name
      : 
      www.shuhari.local
    • Email Address
      : 
      info@shuhari.local

Important: The Common Name (CN) must match the web server name.

  • Result: The CSR for the web server is now ready.

Here’s the continuation of your organized and simplified notes:

20. Copy the CSR to Sub CA

On the Deb3 machine, copy the CSR file to the Sub CA machine:

bash
scp /home/shuhari/certs/www.shuhari.local.csr.pem shuhari@<subca_ip>:/home/shuhari/subca/csr

21. Generate the Signed Certificate for the Web Server

On the Sub CA machine, sign the web server’s CSR using the Sub CA’s private key:

bash
cd subca
openssl ca -config subca.cnf -extensions server_cert -days 375 -notext -md sha256 -in csr/www.shuhari.local.csr.pem -out certs/www.shuhari.local.cert.pem

  • Explanation:

    • ca
      : OpenSSL acts as a Certificate Authority.
    • -config
      : Specifies the configuration file (
      subca.cnf
      ).
    • -extensions
      : Uses the 
      server_cert
      template.
    • -days
      : Sets the certificate validity period to 375 days.
    • -notext
      : Disables extra text output.
    • -md sha256
      : Uses SHA-256 for hashing.
    • -in
      : Input CSR file.
    • -out
      : Output signed certificate.

  • Result: A signed certificate for the web server is generated.

22. Copy the Signed Certificate Back to Deb3

On the Sub CA machine, copy the signed certificate to the Deb3 machine:

bash
scp /home/shuhari/subca/certs/www.shuhari.local.cert.pem shuhari@<deb3_ip>:/home/shuhari/certs/www.shuhari.local.cert.pem

23. Copy Root CA and Sub CA Certificates to Deb3

  1. Copy the Root CA certificate:

    bash
    scp /home/shuhari/ca/certs/ca.cert.pem shuhari@<deb3_ip>:/home/shuhari/certs/

  2. Copy the Sub CA certificate:

    bash
    scp /home/shuhari/subca/certs/subca.cert.pem shuhari@<deb3_ip>:/home/shuhari/certs/

24. Create the Bundle Certificate

On the Deb3 machine, combine all certificates into a bundle to establish the chain of trust:

bash
cd certs
cat www.shuhari.local.cert.pem subca.cert.pem ca.cert.pem > bundle.cert.pem
cat bundle.cert.pem

  • Explanation:

    • The bundle certificate links the web server certificate with the Sub CA and Root CA certificates, forming a complete chain of trust.
    • Use 
      cat
      to view the content of the 
      bundle.cert.pem
      .

  • Result: PKI configuration is complete.

25. Configure the HTTP Server on Deb3

  1. Verify if Apache2 is installed:

    bash
    sudo which apache2

  2. Install Apache2 if not already installed:

    bash
    sudo apt-get install apache2

  3. Create a directory for SSL files:

    bash
    sudo mkdir -p /etc/apache2/ssl

  4. Copy the bundle certificate and private key to the SSL directory:

    bash
    sudo cp bundle.cert.pem /etc/apache2/ssl/
sudo cp www.shuhari.local.key.pem /etc/apache2/ssl/

  5. Secure the SSL files by limiting permissions:

    bash
    sudo chmod 600 /etc/apache2/ssl/*

26. Implement Encryption for the Web Server

  1. Enable the SSL module in Apache2:

    bash
    sudo a2enmod ssl

  2. Check the 

    sites-available
    and 
    sites-enabled
    directories:

    bash
    sudo ls -l /etc/apache2/sites-available/
sudo ls -l /etc/apache2/sites-enabled/

    • You’ll notice that the 

      default-ssl.conf
      file exists in 
      sites-available
      but not in 
      sites-enabled
      .

    • Use the following command to enable the site, creating a symbolic link from 

      sites-available
      to 
      sites-enabled
      :

      bash
      sudo a2ensite default-ssl

  3. Verify that the site is now enabled:

    bash
    sudo ls -l /etc/apache2/sites-enabled/

  4. Edit the 

    default-ssl.conf
    file:

    bash
    sudo vim /etc/apache2/sites-available/default-ssl.conf

    • Add the following line on the 3rd line:

      plaintext
      ServerName www.shuhari.local:443

    • Update the paths for the certificate and key files:

      plaintext
      SSLCertificateFile /etc/apache2/ssl/bundle.cert.pem
SSLCertificateKeyFile /etc/apache2/ssl/www.shuhari.local.key.pem

  5. Restart the Apache2 service to apply the changes:

    bash
    sudo systemctl restart apache2
sudo systemctl status apache2

27. Test the Website

  1. Open a browser and try accessing the website:

    plaintext
    https://www.shuhari.local

  2. You will encounter a warning for an insecure website because the browser doesn’t yet trust your certificate. However, you can inspect the certificate trust chain in the browser.

28. Import the Root CA Certificate in Windows

  1. Copy the 

    Root CA
    certificate to your Windows machine.

  2. Import the certificate:

    • Open Manage User Certificates.

    • Navigate to:

      plaintext
      Trusted Root Certification Authorities → Certificates

    • Right-click and select:

      plaintext
      All tasks → Import

    • Follow the wizard:

      • Click Next.
      • Select the certificate file you copied to your Windows machine.
      • Click Next and Finish.

  3. Update the DNS entries on your Windows machine:

    • Open Network Connections:

      plaintext
      ncpa.cpl

    • Modify the DNS settings for both your Wi-Fi adapter and VMWare adapter to include your DNS server's IP address.

29. Access the Website Again

  • Open a browser and go to:

    plaintext
    https://www.shuhari.local

  • This time, the browser should trust the certificate, and you can securely access the website without warnings.

Read Next

8/26/2026

[Day 10] 2. IDS (Intrusion Detection System)

## **Intrusion** An intrusion is an unauthorized attempt to access, manipulate, or disable a computer system or network. IDS helps to monitor and d...

8/26/2026

[Day 10] 3. NFQueue and the IPS mode of Suricata

### **NFQueue**: NFQueue is a feature of Linux's Netfilter framework that allows packets to move from the kernel to user space. This lets applicati...