NDC & PKI

[Day 8] 1. PKI using XCA (LAB 1)

D
DITISS Admin
••10 min read

1. Installation of XCA

  • Install XCA on your Windows machine using the "typical" installation option.
  • Complete the installation and run the application.

2. Folder Setup for Certificates

  • Create a main folder (location of your choice) and add the following three subfolders to store the database: 
    • 001-RootCA
    • 002-SubCA
    • 003-Tinku

3. Creating the Root CA Database

  • Open XCA and create a 
    .xdb
    file inside the 
    001-RootCA
    folder. This will serve as the database for the Root CA.

4. Creating a Template for Certificates

  • Navigate to the Templates tab and create a new template.
    • Select Empty Template.
    • Name the template: Shuhari General Template.
    • Set Organization Unit Name as IS (leave Common Name and Email empty).
    • Fill in the remaining fields with appropriate details and click Add.
  • Export this template to the main folder containing the subfolders (
    001-RootCA
    , 
    002-SubCA
    , and 
    003-Tinku
    ).

5. Generating the Root CA Private Key

  • Go to the Private Key tab and click on Generate.
  • Name the key Shuhari Root CA and click OK to create the private key.

6. Creating the Root CA Certificate

  • Switch to the Certificates tab and click on New Certificate.
  • In the Subject tab, verify if it is empty.
  • Go to the Source tab, where you’ll find the Shuhari General Template. Click Apply Subject. The subject fields will be populated.
    • Name the certificate: Shuhari Root CA Certificate.
    • Set the Common Name to ShuHaRi Root CA and Email to 
      info@shuhari.local
      .
    • Other details will auto-fill based on the template.

7. Applying Extensions and Key Usage

  • In the Source tab, select the CA (default) template and press Apply Extensions.
  • You’ll see the extensions populated in the Extensions tab, and additional details in the Advanced tab.
  • In the Key Usage tab, ensure the appropriate permissions are selected (two options will be pre-selected).

8. Self-Signing the Root CA Certificate

  • Under the Source tab, select the option Create a self-signed certificate (this is required for the Root CA certificate).
  • Review all settings and click OK.
  • Export the self-signed certificate.

9. Conclusion: Root CA Creation

  • The following items are now created:

    • Private Key (generated earlier).
    • Public Key (automatically generated).
    • Certificate (self-signed).

  • You have now successfully created the Root CA.

  • After completing this, close the database.

10. Creating the SubCA Database

  • Create a new database inside the 
    002-SubCA
    folder.
  • Note: There is no default template for SubCA, so we’ll import the template created previously.
    • Import the template that was exported during the Root CA creation.
    • The template will appear in the dashboard. You can rename it if desired.

11. Generating the SubCA Private Key

  • Go to the Private Key tab and generate a new key.
    • Name the key ShuHaRi subca private key.
    • Set a password and click OK to create the private key.

12. Creating the CSR (Certificate Signing Request)

  • Go to the CSR tab and create a new request.
    • Name the request: subca csr.
    • Set a password for the request.
    • Select the Shuhari General Template (the imported template).
  • In the Subject tab:
    • Set the Common Name to ShuHaRi Sub CA.
    • Set the Email to info@shuhari.local.
    • Name the certificate shuhari sub ca.

13. Adding Extensions to CSR

  • In the Source tab, select the CA template and add the necessary extensions.
  • Check all the entries to ensure correctness.
  • Click OK to finalize the CSR.

14. Exporting the CSR Template

  • Export this CSR template for further use inside the 
    002-SubCA
    folder.

15. Closing the SubCA Database

  • Close the SubCA database and open the Root CA database.

16. Signing the SubCA CSR with the Root CA

  • Import the CSR into the Root CA database from the CSR tab.
  • Go to New Certificate and select the option to sign the certificate signing request:
    • Choose shuahri sub ca from the list of requests.
    • Select Copy Extensions from the request and check the option Modify the subject of the request.
    • Select Use this certificate for signing.
  • Go to the Subject tab and verify that all details are correct.
  • In the Extensions tab, modify the validity period to something less than 10 years (e.g., 5 years), which is shorter than the Root CA’s validity period.
    • Apply extensions from the Source tab (choose the CA template).
    • In the Extensions tab, finalize the validity period to 5 years.
  • Click OK to sign the certificate.

17. Viewing the Hierarchy

  • After signing, you will be able to see the Root CA and SubCA hierarchy.

18. Exporting the Signed SubCA Certificate

  • Go to Export and choose the 
    .pem
    format for the certificate.
  • Save the exported certificate in the 
    002-SubCA
    folder.
    • Name the file as ShuHaRi_Sub_CA_Certificate.pem and click OK.

19. Closing the Root CA Database

  • Close the Root CA database after exporting the signed certificate.

20. Importing the Signed Certificate into the SubCA Database

  • Open the SubCA database.
  • As there are no certificates yet, import the 
    .pem
    certificate that was exported from the Root CA.
    • This certificate defines the Root CA above and the SubCA below, ensuring the chain of trust.

21. Creating a Database for Tinku

  • Open XCA and create a new database for Tinku (name it as desired).

22. Generating the Private Key for Tinku

  • In the Private Key tab, create a new key:
    • Name it: tinku private key.

23. Creating a CSR (Certificate Signing Request) for Tinku

  • Go to the CSR tab and create a new request:
    • Name it: tinku CSR.
    • Do not enter a password for the CSR.
  • Import the SubCA template from the previously created SubCA database.
  • In the Subject tab:
    • Fill in Common Name and Email.
    • Key Usage: Select Digital Signature only.
  • Check that the details are correct and ensure the certificate is visible.
  • Export the CSR to the Tinku folder.

24. Issuing Tinku’s Certificate from the SubCA

  • Log into the SubCA database and import Tinku’s CSR.
  • Issue the certificate for Tinku:
    • Go to New Certificate and select Tinku’s CSR.
    • Check the following options:
      • Use this certificate for signing (select the SubCA’s certificate).
      • Extensions: Set the validity period to 1 year.
      • Key Usage: Select Digital Signature only.
  • Ensure all details are correct and click OK to issue the certificate.
  • Export this certificate in .pfx format and save it in Tinku’s folder with an appropriate name.

25. Trusting the CA in Windows

  • Open XCA, and open the Root CA database.
  • Export the Root CA certificate:
    • Choose the .crt extension and save it in the Root CA folder with a descriptive name.
  • Open Certificate Manager (search for it in the Windows machine):
    • Go to Trusted Root Certification Authorities > Certificates.
    • Right-click and select All Tasks > Import.
    • Import the Root CA certificate from the Root CA folder.
    • Accept any dialogue box prompts, and verify the certificate is listed under Trusted Root CA.

26. Importing Tinku’s Certificate in Windows

  • In the Certificate Manager, go to Personal > Certificates.
    • Right-click and select All Tasks > Import.
    • Import Tinku’s certificate from the Tinku’s folder.
    • After successful import, Tinku’s certificate should be listed under Personal Certificates.

27. Verifying Digital Signature in Word Document

  • Create a Word document and add some content.
  • In Word, select Insert > Add a Digital Signature.
  • Fill in the required details and click OK.
  • The document will now show as protected (digitally signed).

28. Verifying Digital Signature in PDF Document

  • For PDF, you need Adobe Acrobat Reader.
    • First, create a non-digitally signed Word document.
    • Convert it to a PDF (File -> Print -> PDF).
    • Open the PDF in Adobe Acrobat.
    • Select Use a Certificate to sign the document.
    • Choose a space on the document to place the signature and click Next.
    • Continue and sign the document.
  • A new signed PDF document will be created. Save it and try opening it. It will now show Tinku’s digital signature.

Summary:

  • Created and issued a certificate for Tinku using the Root CA and SubCA chain.
  • Configured trust for the CA in Windows.
  • Verified digital signature functionality by signing both Word and PDF documents with Tinku’s certificate.

Read Next

8/26/2026

[Day 8] 2. SNORT on Linux (LAB 2)

#### **1. Installing Dependencies** Run the following command to install necessary dependencies: ```bash sudo apt-get install -y bison ca-certi...

8/26/2026

[Day 8] 3. Implementing Fail2Ban for SSH Protection on Linux (LAB 3)

### **1. Install Dependencies on the Victim Machine** On the victim machine (`192.168.80.128`), run the following command to install `fail2ban` and...