O’Reilly.net: Creating Your Own CA

“Well-known Certificate Authorities (such as Thawte and
VeriSign) exist to serve as authoritative, trusted third-parties
for authentication. They are in the business of signing SSL
certificates that are used on sites that deal with sensitive
information (like account numbers or passwords). If a site’s SSL
certificate is signed by a trusted authority, then presumably it is
possible to verify the identity of a server supplying that
certificate’s credentials. In order to receive a certificate
‘blessed’ by a well-known CA, you have to prove to them beyond a
shadow of doubt that not only are you who you claim to be, but that
you have the right to use the certificate in the way you intend
to.

“For example, I may be able to prove to a CA that I am really
Rob Flickenger, but they probably won’t issue me a signed
certificate for Microsoft Corporation, as I have no rights to use
that name. (Yes, they probably wouldn’t do that. Not again.)

“In this article, I’ll show how OpenSSL is perfectly capable of
generating everything you need to run your own Certificate
Authority. The CA.pl utility makes the process very simple…”

Complete
Story