Create a Mutual Authentication root certificate

To properly configure Mutual Authentication, you need to create a root certificate that you want to use to create and validate client certificates.

Before you begin

  • Make sure your environment meets the minimum requirements to complete this procedure. See System requirements.
  • Prepare a CA root certificate configuration file.
    An example of content in a root.conf file
    [req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
x509_extensions	= v3_ca
# subject distinguished name
distinguished_name = dn

[dn]
# country
C = US
# state
ST = Massachusetts
# city
L = Cambridge
# organization
O = Organization
# organization unit
OU = IoT
# email
emailAddress = test@email.com
# common name
CN = www.organization.test.com

[req_ext]
# subject alternative name
subjectAltName = @alt_names
# netscape comment
nsComment = "This is netscape comment"

[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints = CA:true

[alt_names]
DNS.1 = test.example.com

All the files used in the task are in the same directory. The commands use these variables for the file names:
  • root.conf is the configuration file for the CA root certificate.
  • rootCA.crt is the CA root certificate you previously created.
  • rootCA.key is the CA root private key that you previously created.

How to

  1. Create a certificate key for your domain.
    You can use the following command: openssl genrsa -des3 -out rootCA.key 4096
    A rootCA.key appears in your current directory.
  2. Using your CA root certificate key and the CA root configuration file, generate the CA root certificate.
    Make sure to set the basicConstraints value in the root.conf file to CA:true. This value indicates whether a certificate is a CA certificate.
    You can use the following command: openssl req -x509 -config root.conf -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt
    A rootCA.crt file appears in your current directory.
  3. Upload the Mutual Authentication root certificate.