[Day 9] 1. PKI Lab in Short (XCA)

Naming Conventions for Better Understanding

Root CA

1. 001-001-DB-rootca.xdb – Root CA Database
2. 001-002-CRT-RootCA.crt – Root CA Certificate

Sub CA

1. 002-001-DB-subca.xdb – Sub CA Database
2. 002-002-CSR-SubCA.crt – Sub CA Certificate Signing Request
3. 002-003-CRT-SubCA.crt – Sub CA Certificate

Tinku

1. 003-001-DB-tinku.xdb – Tinku's Database
2. 003-002-CSR-tinku.pem – Tinku's Certificate Signing Request
3. 003-003-CRT-tinku.crt – Tinku's Certificate
4. 003-004-CRT_CHAIN_KEY-tinku.pfx – Tinku's Certificate with Private Key

---

Steps for PKI Setup

1. Root CA Setup

1. Create a Private Key in Root CA.
2. Create a Self-Signed Certificate in Root CA:
   • Use the "General CA Certificate" template.
   • Fill in details and name it ShuHaRi General Certificate.
3. Export the certificate to the Root CA folder.
4. Import the exported certificate into Tinku's database.

---

2. Sub CA Setup

1. Create a Private Key for Sub CA.
2. Create a CSR (Certificate Signing Request):
   • Apply CA extension.
   • Name it ShuHaRi SubCA Certificate and fill in the details.
3. Export the CSR to the Sub CA folder.
4. Import the CSR into Root CA.
5. Issue the Sub CA Certificate:
   • Use the "Use this Certificate for Signing" option.
   • Create and export the certificate to the Sub CA folder.
6. Go to Tinku and import the Sub CA certificate to view the certificate hierarchy.

---

3. Tinku Setup

1. Create a Private Key for Tinku.
2. Create a CSR (New Request):
   • Subject Name:
     Copy

     tinku@shuaril.local

   • Email:
     Copy

     info@shuhari.local

   • Click OK and export the CSR to Tinku's folder.
3. Import the CSR into Sub CA and issue a certificate:
   • No template needed.
4. Export Tinku's Certificate to the Tinku folder.

---

4. Finalizing the Chain of Trust

1. Import Certificates in Tinku:
   • Import the Sub CA certificate.
   • Export the certificate with
     Copy

     .pfx

     extension (bind private key and certificate):
     • Use Tinku's password.
     • Save in Tinku folder.
2. Go to MMC (Microsoft Management Console):
   • Import the Root CA certificate.
   • Import Tinku's
     Copy

     .pfx

     file:
     • Enter password, click Next, and OK.
3. Verify that Tinku's Certificate is now visible.

---

5. Protecting Documents

Follow your existing steps to protect Word and PDF documents using the certificate chain.

---