root_ca - dwilson2547/wiki_demo GitHub Wiki

A Root Certificate Authority (Root CA) is the top-level, most trusted entity in a Public Key Infrastructure (PKI). It is responsible for issuing and signing certificates for intermediate CAs and, indirectly, for end-entity certificates (e.g., web server certificates). Root CAs are the anchor of trust in PKI, and their certificates are self-signed, meaning they are signed using their own private key.

• What Is a Root Certificate Authority (Root CA)?
• 1. Key Characteristics of a Root CA
• 2. Role of a Root CA
  • A. Establishing Trust
  • B. Issuing Intermediate CA Certificates
  • C. Certificate Revocation
• 3. How to Create a Root CA
  • Step 1: Install OpenSSL
  • Step 2: Create a Configuration File
  • Step 3: Generate the Root CA Private Key
  • Step 4: Generate the Root CA Certificate
  • Step 5: Verify the Root CA Certificate
  • Step 6: Distribute the Root CA Certificate
  • Step 7: Secure the Root CA Private Key
• 4. Using the Root CA to Issue Intermediate CA Certificates
  • Step 1: Create a Configuration File for the Intermediate CA
  • Step 2: Generate the Intermediate CA Private Key
  • Step 3: Generate a CSR for the Intermediate CA
  • Step 4: Sign the Intermediate CA CSR with the Root CA
  • Step 5: Verify the Intermediate CA Certificate
• 5. Summary Table: Creating a Root CA
• 6. Best Practices for Managing a Root CA
• 7. Example: Root CA Certificate
• 8. Common Pitfalls and How to Avoid Them
• 9. Conclusion

• Root CAs are the ultimate source of trust in PKI.
• Their certificates are pre-installed in clients (e.g., browsers, operating systems), so clients inherently trust any certificate signed (directly or indirectly) by a root CA.

• Root CAs do not typically sign end-entity certificates directly. Instead, they issue certificates to intermediate CAs, which then issue end-entity certificates.
• This delegation of trust allows the root CA to remain secure and offline.

• Root CAs maintain Certificate Revocation Lists (CRLs) or support OCSP (Online Certificate Status Protocol) to revoke compromised or invalid certificates.

Creating a root CA involves generating a self-signed certificate and setting up the necessary infrastructure to manage it. Below is a step-by-step guide using OpenSSL, a widely used tool for PKI operations.

Ensure OpenSSL is installed on your system. You can install it using your package manager (e.g., apt, yum, or brew).

Create a configuration file (e.g., root-ca.conf) to define the root CA’s settings:

[ req ]
default_bits            = 4096
default_keyfile         = root-ca.key
distinguished_name      = req_distinguished_name
prompt                  = no
policy                  = policy_anything
x509_extensions         = root_ca_extensions

[ req_distinguished_name ]
countryName             = US
stateOrProvinceName     = California
localityName            = San Francisco
organizationName        = Example Org
commonName              = Example Root CA

[ root_ca_extensions ]
basicConstraints        = critical, CA:true
keyUsage                = critical, keyCertSign, cRLSign
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer

Generate a private key for the root CA. Use a strong key size (e.g., 4096 bits for RSA):

openssl genpkey -algorithm RSA -out root-ca.key -pkeyopt rsa_keygen_bits:4096

Generate a self-signed root CA certificate using the private key and configuration file:

openssl req -x509 -new -key root-ca.key -days 3650 -out root-ca.crt -config root-ca.conf

• -x509: Specifies that a self-signed certificate should be generated.
• -days 3650: Sets the validity period to 10 years.
• -out root-ca.crt: Specifies the output file for the certificate.

Verify the contents of the root CA certificate:

openssl x509 -in root-ca.crt -text -noout

This command displays the certificate details, including the subject, issuer, validity period, and extensions.

• The root CA certificate (root-ca.crt) must be distributed to all clients that need to trust it.
• For testing, you can manually install it in the client’s trust store (e.g., browser, operating system).
• For production, root CA certificates are typically pre-installed in clients by the vendor (e.g., Microsoft, Apple, Mozilla).

• The root CA private key (root-ca.key) must be kept secure and offline to prevent compromise.
• Store it in a hardware security module (HSM) or an offline, air-gapped system.

Once the root CA is set up, you can use it to issue certificates for intermediate CAs. Here’s how:

Create a configuration file (e.g., intermediate-ca.conf) for the intermediate CA:

[ req ]
default_bits            = 2048
default_keyfile         = intermediate-ca.key
distinguished_name      = req_distinguished_name
prompt                  = no
policy                  = policy_anything

[ req_distinguished_name ]
countryName             = US
stateOrProvinceName     = California
localityName            = San Francisco
organizationName        = Example Org
commonName              = Example Intermediate CA

[ intermediate_ca_extensions ]
basicConstraints        = critical, CA:true, pathlen:0
keyUsage                = critical, keyCertSign, cRLSign
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer

Generate a private key for the intermediate CA:

openssl genpkey -algorithm RSA -out intermediate-ca.key -pkeyopt rsa_keygen_bits:2048

Generate a Certificate Signing Request (CSR) for the intermediate CA:

openssl req -new -key intermediate-ca.key -out intermediate-ca.csr -config intermediate-ca.conf

Use the root CA to sign the intermediate CA’s CSR:

openssl x509 -req -in intermediate-ca.csr -CA root-ca.crt -CAkey root-ca.key -CAcreateserial -out intermediate-ca.crt -days 1825 -extfile intermediate-ca.conf -extensions intermediate_ca_extensions

• -CA root-ca.crt: Specifies the root CA certificate.
• -CAkey root-ca.key: Specifies the root CA private key.
• -CAcreateserial: Creates a serial number file for the CA.
• -extfile: Specifies the configuration file for extensions.
• -extensions: Specifies the section in the configuration file for extensions.

Verify the intermediate CA certificate:

openssl x509 -in intermediate-ca.crt -text -noout

• Keep the Root CA Offline: Store the root CA’s private key in an offline, secure environment (e.g., HSM or air-gapped system).
• Use Strong Key Sizes: Use 4096-bit RSA or 256-bit ECDSA for the root CA’s private key.
• Long Validity Period: Set a long validity period (e.g., 10–20 years) for the root CA certificate.
• Limit Access: Restrict access to the root CA’s private key to authorized personnel only.
• Use Intermediate CAs: Delegate certificate issuance to intermediate CAs to minimize the root CA’s exposure.
• Monitor and Audit: Regularly audit the root CA’s activities and monitor for unauthorized access.

Here’s an example of what a root CA certificate looks like when viewed using OpenSSL:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=California, L=San Francisco, O=Example Org, CN=Example Root CA
        Validity:
            Not Before: Jan  1 00:00:00 2025 GMT
            Not After : Dec 31 23:59:59 2034 GMT
        Subject: C=US, ST=California, L=San Francisco, O=Example Org, CN=Example Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:aa:bb:cc:...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AB:CD:EF:12:...
            X509v3 Authority Key Identifier:
                keyid:AB:CD:EF:12:...
    Signature Algorithm: sha256WithRSAEncryption
         3a:4b:5c:6d:7e:8f:9g:0h:1i:2j:3k:4l:5m:6n:7o:8p:9q:0r:...

A Root Certificate Authority (Root CA) is the foundation of trust in PKI. It issues and signs certificates for intermediate CAs, which in turn issue certificates for end entities. Creating a root CA involves generating a self-signed certificate and securing its private key. By following best practices, you can ensure the security and integrity of your PKI.

Would you like to explore how to set up an intermediate CA, how to revoke certificates, or how to integrate your root CA with applications?