TLS/SSL authentication and encryption methods can be applied to the socket layer to secure Internet or network communication.

For TLS/SSL encryption, various certificates and encryption keys are basically required as shown in the figure below.

This page shows an example of generating encryption keys and certificates required for TCP/UDP, HTTPS, and MQTTS using OpenSSL.

 

 

♦ Refer to OpenSSL 설치하기 | momoiot for OpenSSL installation.

 

 

 

 

 

1. Generating the CA key and certificate

 

Procedure	Command
Path to OpenSSL/bin
CA security key generation	OpenSSL/bin>openssl genrsa -des3 -out ca.key 2048
CA certificate generation	OpenSSL/bin>openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

 

 

♦ CA security key generation

	ca.key value= input  arbitrarily.
	Recheck the ca.key value.

 

 

♦ CA certificate generation

Items to input Default Value Example Input Pass Phrase – – Input ca.key(PW) Country Name AU Enter Key State or Province Some-State Enter Key Locality Name   Enter Key Organization Name Internet Widgits Ltd Enter Key Organization Unit   Enter Key Common Name   Enter Key Email Address   Enter Key

 

 

 

 

 

♦ Generate server security key

⊕ OpenSSL에서 만들어진 이 보안키 파일에는 개인키와 공개키가 모두 포함되어 있다.

 

♦ Generate Server CSR

입력항목 Default 값 Example Country Name AU Enter Key State or Province Some-State Enter Key Locality Name   Enter Key Organization Name Internet Widgits Ltd Enter Key Organization Unit   Enter Key Common Name   momopc Email Address   Enter Key Challenge password   Enter Key Option company name   Enter Key

 

⊗ For the Common Name, there is no problem in generating a certificate even if an arbitrary value is entered.

However, for compatibility when testing in various tools, be sure to enter the Host Name or IP of the PC where the server is installed. 

⊗ as possible, if Common Name is entered as Host Name, input Host Name, and vice versa if IP is entered. 

(There seems to be a compatibility difference depending on the tool/PC)

 

 

♦ Send CSR to CA → CA Signing → Issue Server certificate

 

 

 

 

 

 

 

3. Generating the client key and certificate

 

 

⊕ openssl genrsa -out client.key, when the 2048 option is used, the pass phrase for the client key is not used.

⊕ When using MQTT.fx in a later test, it seems that the client key with pass phrase is not compatible.

The command to modify From a key with a passphrase to a key without a passphrase key is as follows.

    → openssl rsa -in client.key -out client-new.key

 

 

♦ Generate client security key

⊕ In all subsequent tests, the passphrase for the client key will not be used except in special cases.

 

⊕ This security key file created by OpenSSL contains both private and public keys.

 

 

♦ Generate client CSR

 

Input Items Default Value Example Input Country Name AU Enter Key State or Province Some-State Enter Key Locality Name   Enter Key Organization Name Internet Widgits Ltd Enter Key Organization Unit   Enter Key Common Name   momopc Email Address   Enter Key Challenge password   Enter Key Option company name   Enter Key

 

 

 

♦ Send CSR to CA → CA Signing → Issue Client Certificate

 

 

 

♦ Validating Client Certificates

 

 

 

 

 

4.  Viewing certificate

> openssl x509 -in client.crt -text -noout