gen-self-signed-cert

Dead-simple, portable generation of host self-signed x509 cert via temporary root CA.

Purpose

This package provides simple, cross-platform generation of self-signed client and server TLS certs. It is intended for cases where it is infeasible to use a more complete internal CA.

Installation

See the Releases page. Download and extract the binary for your platform.

Usage

Commands below are for OSX/Linux; for Windows use gen-self-signed-cert.exe.

1. Generate the CA and host certificate for your host (here, myhost.example.com):
   • to create a plaintext key file

     gen-self-signed-cert -host myhost.example.com

   • to create a password-protected, AES-256 encrypted key file

     gen-self-signed-cert -encrypt -host myhost.example.com

2. Send the ca.crt file to the system that needs to authenticate your host, and configure that system to trust your CA. For example:
   • For a HAProxy server performing client certificate authentication, this would be the ca-file.
   • For a curl client authenticating a server, this would be the --cacert flag, as in:

     curl --cacert ca.crt https://myhost.example.com

3. Configure your host to use the combination of host.crt and host.key to authenticate itself.
   • For a curl client performing client certificate authentication, these would be the --cert and --key flags, as in:

     curl --cert host.crt --key host.key https://some.server.com

   • For a HAProxy server terminating TLS, these would be combined into the ssl crt /etc/ssl/xip.io/xip.io.pem file.