| blob | 4a4a1e30684bf27241f3485b836e2f014ba11491 |
1 Easy Certificate Creation (EZCert)
2 ==================================
5 SSH Public Key To Certificate
6 -----------------------------
8 The CACreateCert certificate utility was developed in order to
9 facilitate using X509 client certificates for authentication with
10 a web server over the https protocol when all the user has uploaded
11 to the server for identification is an OpenSSH RSA public key (e.g.
12 id_rsa.pub).
14 (In other words, the user pastes an OpenSSH RSA public key into a
15 form on the web server and the web server responds with a client
16 certificate that the user can then download and use together with
17 the corresponding private key to authenticate to that web server.)
20 Any Old Certificate
21 -------------------
23 However, the CACreateCert utility has grown a number of additional
24 options making it useful for creation of several other kinds of
25 X509 certificates.
27 It may be helpful to first view the Example.html page to see how a
28 full set of certificates and keys for a complete certificate chain
29 may be generated (including individual user client authentication
30 certificates). If more detail is needed on the veritable plethora
31 of options available when running the CACreateCert utility, look
32 at the output of the CACreateCert -h command.
35 Secure E-mail
36 -------------
38 Secure email in the form of S/MIME has existed since before the start
39 of the 21st century. To use S/MIME to transmit encrypted email(s), both
40 the sender and the receiver must each have an "email" certificate that
41 contains their "public" key and email address and they must possess the
42 non-shared private key that goes with the "public" key. However, since
43 these are X.509 certificates we are talking about, and X.509 certificates
44 are always validated in a chain where there must always be at least two
45 certificates in any valid chain (a "root" certificate and a "leaf"
46 certificate), the "email" certificate (which is the "leaf" certificate)
47 will need a "root" certificate that signs it.
49 It is possible to create a "root" self-signed "email" certificate.
50 This is not really recommended because it does not conform to the
51 standard and therefore email encrypted and/or signed with such a
52 certificate might be rejected by the receiver.
54 However, using the `--acme` option, it's trivial to use the CACreateCert
55 utility to create a root certificate and then use that to sign your
56 "email" leaf certificate generated with the `--email` option.
58 The `CACreateCert --help` output contains a "CREATING AN EMAIL CERTIFICATE"
59 example in the "EXAMPLES" section that demonstrates how to create your very
60 own email signing certificate.
63 Convert Public Key Formats Too
64 ------------------------------
66 A ConvertPubKey utility is also provided that can convert between
67 OpenSSH and X.509 public key formats without using OpenSSH or OpenSSL.
70 License
71 -------
73 This software is licensed under the GNU Affero General Public License
74 as published by the Free Software Foundation, either version 3 of
75 the License, or (at your option) any later version. See the included
76 file LICENSE.txt or the web site <http://www.gnu.org/licenses/>.