<DRAFT!>			HOWTO certificates1. IntroductionHow you handle certificates depend a great deal on what your role is.Your role can be one or several of:  - User of some client software  - User of some server software  - Certificate authorityThis file is for users who wish to get a certificate of their own.Certificate authorities should read ca.txt.In all the cases shown below, the standard configuration file, ascompiled into openssl, will be used.  You may find it in /etc/,/usr/local/ssl/ or somewhere else.  The name is openssl.cnf, andis better described in another HOWTO <config.txt?>.  If you want touse a different configuration file, use the argument '-config {file}'with the command shown below.2. Relationship with keysCertificates are related to public key cryptography by containing apublic key.  To be useful, there must be a corresponding private keysomewhere.  With OpenSSL, public keys are easily derived from privatekeys, so before you create a certificate or a certificate request, youneed to create a private key.Private keys are generated with 'openssl genrsa' if you want a RSAprivate key, or 'openssl gendsa' if you want a DSA private key.Further information on how to create private keys can be found inanother HOWTO <keys.txt?>.  The rest of this text assumes you havea private key in the file privkey.pem.3. Creating a certificate requestTo create a certificate, you need to start with a certificaterequest (or, as some certificate authorities like to putit, "certificate signing request", since that's exactly what they do,they sign it and give you the result back, thus making it authenticaccording to their policies).  A certificate request can then be sentto a certificate authority to get it signed into a certificate, or ifyou have your own certificate authority, you may sign it yourself, orif you need a self-signed certificate (because you just want a testcertificate or because you are setting up your own CA).The certificate request is created like this:  openssl req -new -key privkey.pem -out cert.csrNow, cert.csr can be sent to the certificate authority, if they canhandle files in PEM format.  If not, use the extra argument '-outform'followed by the keyword for the format to use (see another HOWTO<formats.txt?>).  In some cases, that isn't sufficient and you willhave to be more creative.When the certificate authority has then done the checks the need todo (and probably gotten payment from you), they will hand over yournew certificate to you.Section 5 will tell you more on how to handle the certificate youreceived.4. Creating a self-signed test certificateIf you don't want to deal with another certificate authority, or justwant to create a test certificate for yourself.  This is similar tocreating a certificate request, but creates a certificate instead ofa certificate request.  This is NOT the recommended way to create aCA certificate, see ca.txt.  openssl req -new -x509 -key privkey.pem -out cacert.pem -days 10955. What to do with the certificateIf you created everything yourself, or if the certificate authoritywas kind enough, your certificate is a raw DER thing in PEM format.Your key most definitely is if you have followed the examples above.However, some (most?) certificate authorities will encode them withthings like PKCS7 or PKCS12, or something else.  Depending on yourapplications, this may be perfectly OK, it all depends on what theyknow how to decode.  If not, There are a number of OpenSSL tools toconvert between some (most?) formats.So, depending on your application, you may have to convert yourcertificate and your key to various formats, most often also puttingthem together into one file.  The ways to do this is described inanother HOWTO <formats.txt?>, I will just mention the simplest case.In the case of a raw DER thing in PEM format, and assuming that's allright for yor applications, simply concatenating the certificate andthe key into a new file and using that one should be enough.  Withsome applications, you don't even have to do that.By now, you have your cetificate and your private key and can startusing the software that depend on it.-- Richard Levitte