Certificate Assistant - Rolling your own CA on Tiger

Come find the hidden sparkle of the Certificate Manager! Never have to use the openssl commands again! Well almost never.

All you should have to know to create your own CA and get Server Admin to use the certs you've created.

While it's rather interesting that Server Admin can generate certificates for you, it's rather annoying that you can't easily set up your own root certificate with it. By this I mean, that for proper management in larger organizations it's typical to create a root certificate and then sign all server certificates with that root. This way you only have to import one CA certificate onto the client machines and they will trust all of your certs that you created with that.

1. log into your server and using Keychain Access create a new keychain, in our example will use one called "CA Keys".

2. Under the "Keychain Access" menu in Keychain Access pull down to Certificate Assistant. This will launch a very promising, and very unknown, little assistant that will eliminate much of the work from doing this.

3. Use Certificate Assistant to "Create a Certificate Authority", the second option in the list. You'll be asked to fill out a few things for the new root CA. Fill the demographic information out as you see fit. Note that the Common Name in the case of a CA is not related to DNS, so call it Great Big CA if you want.

For the lazy, or those who don't want to bother with the hassle of renewing a root CA, I'd suggest upping the Validity Period to a few years at least.

Click though the next six screens leaving them at their defaults.

4. Finally save the new CA into the keychain that you created in step 1. Congratulations, you know have a brand new CA!

5. Your next problem is that even though you have a CA, you're not even trusting it yourself. So go back to Keychain Access and show all of your keychains, the button on the bottom left of the window. If you are an admin user, you should see both and X509Anchors and an X509Certificates. From your CA keychain drag just the certificate looking item to the X509Anchors keychain.

Quit Keychain Access and relaunch it. Now if you look inside the X509Anchors keychain, you should see an entry for the CA that you created. If you select this you should see that the certificate is now valid and has a green check.

6. Now you can create a server certificate from your CA. So back to the Certificate Assistant. If you've left the application open, due to an interesting quirk with it, you may need to relaunch it to get the window of options back.

You want to pick the first option "Create a certificate for yourself" which will start you down the path to signing certs.

In the next screen uncheck the "Certificate will be 'self-signed' (root)" box, and fill out the demographic information. This time it's imperative that the "Common Name" by the full DNS name of the server or site that you are interested in securing.

Now select the CA that you want to use, if you only have one it should be the default. Otherwise you'll probably want this to be the CA that you just created.

Click through the next few screens, again leaving them at the defaults, and finally save the new server cert into the same keychain as your CA.

7. Back to Keychain Access. Select the CA keychain, in there you should now find 3 items with the common name of the server cert that you just created.

Select the certificate itself and under the "File" menu select to export it in PEM format.

Now select the private key with the server's common name on it and also export it. This time the only format option that you'll have will be p12, which makes this a touch annoying but not insurmountable.

When you export it you'll be asked for a password to secure the private key with, you're more than welcome to put one here for extra security or to leave it blank.

8. Now a slightly crafty part. Certificate Assistant exported the private key as a .p12 format, however Server Admin won't accept it in that style. So we're going to have to convert the key into something that we can use.

In the terminal find the p12 file and convert it using openssl like such:

openssl pkcs12 -in your.key.p12 -nocerts -nodes -out key.pem

9. You should now have a new key.pem file. Using Server Admin, go to the Certificates section which you get to by selecting the server itself, the topmost entry, on the list at the left, then Settings then Certificates.

Here's where you can import the new cert with the "Import" button. The Certificate File is the first file that you exported from your keychain, the one that actually was exported as a .pem.

The Private Key File is the new key.pem that you converted from p12.

That's all you need so save it. After which the new certificate should show up in the list and be available to all of the services that can make use of it.