Trusted Self-signed SSL Certificate and local domains for testing

#security #ssl #trustedslefsignedssl

References
https://gist.github.com/techforum-repo/ff455cf310982e815423c745494e7bc0
https://gist.github.com/techforum-repo/7298e034e2d88a5a64ed7516570d6236
https://gist.github.com/techforum-repo/5b8eea0112d930a30b991a35c42bd7ae
https://gist.github.com/techforum-repo/dd9d7e3b772646423a4917772366f712

Most of the time, we will have a scenario to have different domains other than the localhost to test the applications locally and also to have trusted self-signed SSL certificates.

Let us now see how to quickly set up the local domains and trusted self-signed certificate for testing in windows, the same can be used with other systems with some additional steps.

Sometimes, we may need to have different domains to test our application in the development environment. The DNS setup will consume more time and cost, the local domains help us to test the applications quickly in development environments.

I am going to define the following test domains — myexample.com, sub.myexample.com and myexample1.com

Edit the windows hosts file — C:\Windows\System32\drivers\etc\hosts, add the below entries to map the test domains to 127.0.0.1 so that the defined domains will be able to access the application running on localhost within the same machine.

127.0.0.1 myexample.com
127.0.0.1 sub.myexample.com
127.0.0.1 myexample1.com

Let us now create a self-signed certificate through OpenSSL

Create an RSA-2048 key and save it to a file rootCA.key
openssl genrsa -des3 -out rootCA.key 2048

“Enter passphrase for rootCA.key” — enter a passphrase and store it securely.
Create a root certificate through the key generated
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1460 -out rootCA.pem

Change the validity days as needed
“Enter passphrase for rootCA.key” — enter the passphrase used while generating the root key

Enter the other optional information
Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: MN
Locality Name (eg, city) []:Eagan
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Tech Forum
Organizational Unit Name (eg, section) []:Marketing
Common Name (e.g. server FQDN or YOUR name) []: Local certificate
Email Address []:admin@techforum.com

Now the root certificate is ready, let us Trust the root SSL certificate in the local system
Run the below command through command prompt(run through elevated access)
certutil -addstore -f "ROOT" rootCA.pem

Now the root certificate is added as part of the “Trusted Root Certification Authorities”

You can verify the certificate through Certificate Manager or Certmgr.msc

Even the root certificate can be managed through Browsers, In Chrome navigate to Settings → Privacy and Security →Security → Manage Certificates → Trusted Root Certification Authorities
You can import/export and remove the certificate(the certificates can’t be removed if it was imported through Certmgr.msc)

If you use Firefox for local testing, it will not consider the Root Certificates from the Windows Cert store(Chrome and Edge refer to the root certificates from windows cert store) the Self Signed Root certificate should be imported to Firefox separately.
Navigate to Options→ Privacy and Security →Security → Certificates → View Certificates

You can import/export and remove the certificates, import the rootCA certificate generated in the earlier steps, select “Trust this CA to identify websites”

The root certificate is trusted now, let us issue an SSL certificate to support our local domains — myexample.com, sub.myexample.com, myexample1.com, and localhost for testing.

Create a new OpenSSL configuration file server.csr.cnf, so the configurations details can be used while generating the certificate.

Create a v3.ext file with a list of local SAN domains

Create a private key and CSR (Certificate Signing Request) for the localhost certificate

openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -config server.csr.cnf

This private key is stored on server.key
Let us issue a certificate via the root SSL certificate and the CSR created earlier.
openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 500 -sha256 -extfile v3.ext

“Enter passphrase for rootCA.key:” enter the passphrase used while generating the root key
The output certificate is stored in a file called server.crt.

Let us now enable the certificate for the local server, I am going to configure the certificate with express.js application to enable the trusted SSL communication

Now the certificate is trusted from the browser for the test domains — myexample.com, sub.myexample.com, myexample1.com, and localhost

Видео Trusted Self-signed SSL Certificate and local domains for testing канала Tech Forum