---
title: 'PKI advenced'
url: 'https://tucek.me/en/tech/servers/ca/pki'
markdown: 'https://tucek.me/en/tech/servers/ca/pki.md'
lang: en
date: '2026-08-30'
description: 'We use the certificate server to create certificates and enable secure connection between all our servers and services. We do not need large resources for CA server. I choose 1Gb RAM, a CPU and 10Gb hard disk but we can run it on 512Mb RAM and 3Gb HD. sudo virt-install --virt-type kvm --name ca \ …'
---

# PKI advenced

We use the certificate server to create certificates and enable secure connection between all our servers and services. We do not need large resources for CA server. I choose 1Gb RAM, a CPU and 10Gb hard disk but we can run it on 512Mb RAM and 3Gb HD.

```command
sudo virt-install --virt-type kvm --name ca \
  --location \
  https://deb.debian.org/debian/dists/bullseye/main/installer-amd64/ \
  --memory 1024 \
  --vcpus 1 \
  --disk pool=vmdisks,size=10,format=qcow2 \
  --network bridge=br0 \
  --hvm \
  --graphics none \
  --console pty,target_type=serial \
  --extra-args "console=ttyS0"
```

## Configure Debian

Edit `nano /etc/network/interfaces` and set a static IP address:

```setting
source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback
allow-hotplug ens2
iface ens2 inet static
  address 10.115.100.3/24
  gateway 10.115.100.1
```

`sudo nano /etc/resolv.conf`

```setting
search yourdomain.com
nameserver 1.1.1.1
```

Set the system language to English to make it easier to find problems in the logs:

```command
apt install locales-all
localectl set-locale LANG=en_US.utf8
localectl status
```

### Update Debian and install the necessary administration tools

```commands
apt update
apt install wget sudo screen nmap telnet tcpdump rsync net-tools dnsutils htop \
apt-transport-https vim gnupg lsb-release
```

Create `nano /etc/sudoers.d/10-nopasswd` and add

```setting
%emir ALL=(ALL) NOPASSWD: ALL
```

### Configure VIM

Open `nano /etc/vim/vimrc` and replace all its contents with:

```setting
runtime! debian.vim
syntax on
set background=dark
au BufReadPost * if line("'\"") > 1 && line("'\"") <= line("$") | exe "normal! g'\"" | endif
filetype plugin indent on
set encoding=utf-8
set nobackup
set nowritebackup
set showcmd
set updatetime=300
set showmatch
set ignorecase
set smartcase
set incsearch
set tabstop=2
set softtabstop=2
set shiftwidth=2
set expandtab
if filereadable("/etc/vim/vimrc.local")
  source /etc/vim/vimrc.local
endif
```

Create users vim config file `nano ~/.vimrc` and add:

```setting
set mouse=
set nocompatible
set cursorline
set nocursorcolumn
set nowrap
set showmode
set hlsearch
set wildmenu
set wildmode=list:longest
set wildignore=*.docx,*.jpg,*.png,*.gif,*.pdf,*.pyc,*.exe,*.flv,*.img,*.xlsx
```

From now on we will use VIM insteed for nano.

## PKI

I am going to guide you trought quick configuration off certificate authority, and I am going to publish necessary files.

### Preparation

```command
sudo mgdir /srv/pki
sudo chown -R emir:emir /srv/pki
cd /srv/pki
```

#### Create directories

```command
mkdir -p private certs csr crl certs_by_serial intermediate/certs \
intermediate/private intermediate/csr intermediate/crl \
intermediate/certs_by_serial
```

#### Create index.txt files

```command
touch index.txt intermediate/index.txt private/.rand intermediate/private/.rand
```

#### Create CA serial files for both Root/Intermediate CA’s (Use any 4 digit number)

```command
echo 1000 > serial
echo 1000 > intermediate/serial
```

#### Create CRL serial files for both Root/Intermediate CA’s (Use any 4 digit number)

```command
echo 1000 > crlnumber
echo 1000 > intermediate/crlnumber
```

### RSA

#### Generate root key and certificate: (Rambler Root CA)

```command
openssl genrsa -aes256 -out private/root.key
openssl req -config openssl-root.cnf -days 14600 -new -x509 -sha512 -extensions v3_ca -key private/root.key -out root.pem
```

##### Show certificate

```command
openssl x509 -in root.pem -text
```

#### Generate intermediate key, reqs, and certificate: (Rambler Intermediate CA)

```command
openssl genrsa -aes256 -out intermediate/private/intermediate.key
openssl req -config intermediate/openssl-intermediate.cnf -new -key intermediate/private/intermediate.key -out intermediate/csr/intermediate.csr
openssl ca -config openssl-root.cnf -extensions v3_intermediate_ca -days 14600 -md sha512 -in intermediate/csr/intermediate.csr -out intermediate/intermediate.crt
```

##### Create intermediate certificate in pem (base64) format

```command
openssl x509 -in intermediate/intermediate.crt -out intermediate/intermediate.pem
```

#### Generate CA chain file

```command
cat intermediate/intermediate.crt root.pem > intermediate/chain.crt
```

and chain file in pem format:

```command
cat intermediate/intermediate.pem root.pem > intermediate/chain.pem
```

#### Generate CRL files

```command
openssl ca -config openssl-root.cnf -gencrl -out crl/root.crl
openssl ca -config intermediate/openssl-intermediate.cnf -gencrl -out intermediate/crl/intermediate.crl
```

### Generate a server certificate DC01

Edit `vim intermediate/openssl-server.cnf` and change DNS name:

```setting
[ alt_names ]
DNS.0 = dc01.yourdomain.com
DNS.1 = dc02.yourdomain.com
```

```command
openssl genrsa -aes256 -out intermediate/private/dc01.key
openssl req -config intermediate/openssl-server.cnf -new -key intermediate/private/dc01.key -out intermediate/csr/dc01.csr
openssl ca -config intermediate/openssl-server.cnf -extensions server_cert -days 10950 -in intermediate/csr/dc01.csr -out intermediate/certs/dc01.crt
sudo openssl x509 -in intermediate/certs/dc01.crt -out intermediate/certs/dc01.pem
```

#### Remove encryption from private key

```command
openssl rsa -in intermediate/private/dc01.key -out intermediate/private/dc01-key.pem
```

#### Combine Cert/Key,.crt

```command
cat intermediate/certs/dc01.crt intermediate/private/dc01-key.crt > intermediate/private/dc01.crt
```

#### Combine Cert/Key, pkcs12

```command
openssl pkcs12 -export -inkey intermediate/private/dc01-key.crt -in intermediate/certs/dc01.crt -name dc01 -out intermediate/private/dc01.pfx
```

##### extended pkcs12

```command
openssl pkcs12 -export -inkey intermediate/private/dc01-key.crt -in intermediate/certs/dc01.crt -certfile intermediate/chain.crt -name dc01 -out intermediate/private/dc01.p12
```

##### Do the same for DC02 and copy certificates to respective server:

```command
scp intermediate/private/dc01-key.pem intermediate/certs/dc01.pem intermediate/chain.pem emir@dc01.yourdomain.com:
scp intermediate/private/dc02-key.pem intermediate/certs/dc02.pem intermediate/chain.pem emir@dc02.yourdomain.com:
```

#### Install chain certificate on each DC

```command
# on dc01 and dc02
sudo cp chain.pem /usr/local/share/ca-certificates/chain.crt
sudo update-ca-certificates
```

### Some examples

#### Generate a client authentication certificate

```command
openssl genrsa -aes256 -out intermediate/private/client.key
openssl req -config intermediate/openssl-client.cnf -new -key intermediate/private/client.key -out intermediate/csr/client.csr
openssl ca -config intermediate/openssl-client.cnf -extensions client_cert -days 3650 -in intermediate/csr/client.csr -out intermediate/certs/client.crt
```

#### Remove encryption from private key:

```command
openssl rsa -in intermediate/private/client.key -out intermediate/private/client-key.crt
```

#### Combine Cert/Key,.crt:

```command
cat intermediate/certs/client.crt intermediate/private/client-key.crt > intermediate/private/client.crt
```

#### Combine Cert/Key, pkcs12:

```command
# Regular (Windows)
openssl pkcs12 -export -inkey intermediate/private/client-key.crt -in intermediate/certs/client.crt -name client -out intermediate/private/client.pfx
```

```command
# Regular (Chromebook)
cat intermediate/certs/client.crt intermediate/intermediate.crt > client-configs/keys/client.crt
openssl pkcs12 -export -inkey intermediate/private/client-key.crt -in client-configs/keys/client.crt -name client -out intermediate/private/client-cr.p12
```

```command
# Extended
openssl pkcs12 -export -inkey intermediate/private/client-key.crt -in intermediate/certs/client.crt -certfile intermediate/chain.crt -name client -out intermediate/private/client.p12
```

### OpenVPN

Do everything in pki root directory:

#### Generate a server certificate:

```command
openssl genrsa -aes256 -out private/server.key
openssl req -config intermediate/openssl-server.cnf -new -key private/server.key -out csr/server.csr
openssl ca -config openssl-server.cnf -extensions server_cert -days 10950 -in csr/server.csr -out certs/server.crt
sudo cp certs/server.crt /etc/openvpn/
```

##### Remove encryption from private key:

```command
openssl rsa -in private/server.key -out private/server-key.crt
sudo cp private/server-key.crt /etc/openvpn/
```

#### Generate a client (work) authentication certificate

```command
openssl genrsa -aes256 -out private/work.key
openssl req -config openssl-client.cnf -new -key private/work.key -out csr/work.csr
openssl ca -config openssl-client.cnf -extensions client_cert -days 3650 -in csr/work.csr -out certs/work.crt
cp certs/work.crt client-configs/keys/
```

##### Remove encryption from private key:

```command
openssl rsa -in private/work.key -out private/work-key.crt
cp private/work-key.crt client-configs/keys/
sudo client-configs/make_config.sh work
```

##### Combine Cert/Key, pkcs12

```command
openssl pkcs12 -export -inkey private/work-key.crt -in certs/work.crt -name work -out private/work-cr.p12
cp private/work-cr.p12 ~/openvpn/work/
cp client-configs/files/work.ovpn ~/openvpn/work/
```

#### Generate a client authentication certificate

```command
openssl genrsa -aes256 -out private/client.key
openssl req -config openssl-client.cnf -new -key private/client.key -out csr/client.csr
openssl ca -config openssl-client.cnf -extensions client_cert -days 3650 -in csr/client.csr -out certs/client.crt
cp certs/client.crt client-configs/keys/
```

##### Remove encryption from private key:

```command
openssl rsa -in private/client.key -out private/client-key.crt
cp private/client-key.crt client-configs/keys/
sudo client-configs/make_config.sh client
```

##### Combine Cert/Key, pkcs12:

```command
openssl pkcs12 -export -inkey private/client-key.crt -in certs/client.crt -name client -out private/client-cr.p12
cp private/client-cr.p12 ~/openvpn/client/
cp client-configs/files/client.ovpn ~/openvpn/client/
```

### Administration

```commands
# Revoke certificate
openssl ca -config intermediate/openssl-intermediate.cnf -revoke intermediate/certs/dc01.crt

# View certificate details
openssl x509 -in dc01.pem -noout -text

# Verifying the certificate (local)
openssl verify -CAfile chain.pem dc01.pem

# Veryfi certificate (remote)
openssl s_client -showcerts -connect localhost:636 -CAfile chain.pem
```

---

## Navigation

- Parent: [CA server with Easy-RSA](https://tucek.me/en/tech/servers/ca.md)