Using XCA to create private SSL certificates

This article details using the XCA GUI for creating private SSL certificates for enabling end-to-end SSL on non-public servers.

Preface

This article details using the XCA (available for at least Linux, Windows, and MacOS for creating and managing SSL certificates) software package (it is a GUI) for creating private SSL certificates for enabling end-to-end SSL on non-public servers (e.g. where Let’s Encrypt / Certbot don’t make sense or are not an option).

Obtain XCA

• Obtain XCA for your desktop computer ( https://hohnstaedt.de/xca/)
  • Windows
    • https://github.com/chris2511/xca/releases/download/RELEASE.2.3.0/xca-2.3.0.msi
    • Chocolatey has an xca package
  • Mac
    • https://github.com/chris2511/xca/releases/download/RELEASE.2.3.0/xca-2.3.0.dmg
    • Probably available via homebrew
  • Linux
    • Check for a package in your package manager (Debian/Ubuntu-derivatives should have it available by sudo apt install -y xca for instance).
    • It is also available via Flathub ( https://flathub.org) : flatpak install xca
    • Otherwise try the generic tarball: https://github.com/chris2511/xca/releases/download/RELEASE.2.3.0/xca-2.3.0.tar.gz

Launch XCA

• The usual way for your OS (e.g. on Windows, from the ‘Start’ Menu, on GNOME on Linux, click on the XCA icon in you ‘Applications’ screen, etc).
• This will open a window prompting for a database. If this is is to be a new certificate store (e.g. the first time using XCA or you want a separate store for new certificates) you should create one, otherwise select an existing database and enter the password for it.

Create a self-signed CA (Certificate Authority)

NB Any application that will be using SSL to access a server using a certificate signed by this private CA will need to be told to trust the private CA. This varies with application, so where I use this in other articles, I provide instructions for the particular application in use.

Export the CA’s public key (.crt)

Create a server certificate and private key

1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

9. 

10. Repeat ‘Add’ in this dialogue for every name (DNS) or IP by which the server will be accessed using SSL. If there none besides the CN (Common Name) , then none need to be added.

11. 

12. 

13. 

Export the server certificate and private key

Export the server certificate

1. 

2. Select, ‘Export’ and then use the same steps (with different names) as in Export the CA’s Public Key (.crt)

Export the server private key

Copy the exported files to your server and/or clients

• You will need to copy the at least the server private key and certificate to you server (details are application dependent so for articles on this site will be covered in the article for the application).
• Clients will need the CA certificate and possibly need to per-app configuration to use it. As with the server certificate and key, for articles on this site the details will be covered in the article for the application).

Prepare your user clients to use SSL to the server

NB This is for certificates for web servers, git server, etc where a desktop user will need to access the server via SSL.

• Because we are using a private CA your browser and other desktop clients need to be told to trust the private CA.

1. On any Debian/Ubuntu workstation that needs to access the private CA, copy the private CA certificate (e.g. ca-private.example.com) to /usr/local/share/ca-certificates and execute update-ca-certificates

2. Also on any Debian/Ubuntu workstation for which Firefox needs to access the server:

   mkdir -p /etc/firefox/policies
   sudoedit /etc/firefox/policies/policies.json

   Note: Even when the main Firefox is an ESR release and uses /etc/firefox-esr, for adding policies (like installing certificates) it is necessary to use /etc/firefox/policies/policies.json.

   In policies.json add:

   {
     "policies": {
       "Certificates": {
         "Install": [
           "/usr/local/share/ca-certificates/ca-private.example.com.crt"
         ]
       }
     }
   }

3. On any Windows workstation that needs to access the private CA,

   1. Install the private CA into the system certificate store

      1. 

      2. 

      3. 

      4. 

      5. 

   2. For making the CA available for recent Firefox system-wide:

      1. Create a directory called C:\\ProgramData\\FirefoxCertificates
      2. Copy ca-private.example.com.crt to C:\\ProgramData\\FirefoxCertificates
      3. Create a directory called distribution in C:\\Program Files\\Mozilla Firefox, and in the distribution directory add a file called policies.json containing:

      {
        "policies": {
          "Certificates": {
              "Install": [
                  "C:\\ProgramData\\FirefoxCertificates\\ca-private.example.com.crt"
              ]
          }
        }
      }

   See Also Mozilla’s Github Repository for Policy Templates