Makefile for creating and managing a 3-tier certificate authority.
This is not meant for production use, but because I can.
The passwords for the CA keys are stored on disk.
The make-ca project is a Makefile-based tool for creating and managing a 3-tier certificate authority. It provides a simple and automated way to generate and manage Certificates amd CRLs for various purposes.
The directory structure is simplified for a centralized use case, where one operator manages the CAs.
| level 0 | level 1 | level 2 | description |
|---|---|---|---|
| name | base dir of the ca, e.g. example for Example CA |
||
| archive | renewed and revoked certificates are archived here by ID and timestamp | ||
| ca | CA specific data | ||
| certs | CA certificates go here | ||
| db | CA database and serial files are located here | ||
| new | new issued certificates named by serial no. | ||
| private | private keys of CAs | ||
| reqs | CSRs of the CA certificates | ||
| dist | issued certificates and keys from signing CAs | ||
| etc | openssl configuration files for CAs | ||
| component-ca | template cnf extension subfolders for Component CA | ||
| identity-ca | template cnf and extension subfolders for Identity CA | ||
| pub | public/web distribution folder with CA certs, chains, CRLs |
The following headlines describe the CA structure.
The Root CA of the 3-tier setup, configured in etc/root-ca.cnf.
Issues:
- Intermediate CA certificates
- Root CA CRL
The Intermedite CA of the 3-tier setup, configured in etc/intermediate-ca.cnf.
Issues:
- Signing CA certificates (
pub/*[-chain].{der,pem,txt}) - Intermediate CA CRL (
pub/intermediate-ca.{crl,crl.pem})
The Identity CA (a Signing CA), configured in etc/identity-ca.cnf.
Issues:
smime: S/MIME Certificates for mail signature end encryption (dist/*[-fullchain].{der,pem,txt})- Identity CA CRL (
pub/identity-ca.{crl,crl.pem})
The Component CA (a Signing CA), configured in etc/component-ca.cnf.
Issues:
client: TLS Client certificates (dist/*[-fullchain].{der,pem,txt})server: TLS Server certificates (dist/*[-fullchain].{der,pem,txt})ocsp: OCSP sigingtimestampTimestamp signing- Component CA CRL (
pub/component-ca.{crl,crl.pem})
To install make-ca, follow these steps:
- Clone the repository:
git clone https://github.com/jomrr/make-ca.git /etc/pki/tls/ca/<your name> - Change into the project directory:
cd /etc/pki/tls/ca/<your name> - Customize
settings.mkto your needs - Initialize the CAs wit the command:
make init
Here are a few examples how to use make-ca.
# copy template etc/<CA>/<CERT_TYPE/X509 Extension>/<ID>.cnf
cp etc/component-ca/server.cnf etc/component-ca/server/test.example.com.cnf
# customize CSR data
nvim etc/component-ca/server/test.example.com.cnf
# issue certificate
make certs/component-ca/server/test.example.comUse the CA specific target to revoke, in this case make revoke/*.
make revoke/component-ca/server/test.example.com REASON=supersededCPK_ALG=ED25519 make certs/component-ca/server/test.example.com
# example output:
Signature ok
Certificate Details:
Serial Number:
61:3b:bc:01:8b:c1:34:99:db:1b:b2:e3:8a:0c:77:fa:64:6e:bd:0c
Validity
Not Before: Feb 24 21:25:10 2024 GMT
Not After : Feb 23 21:25:10 2026 GMT
Subject:
countryName = DE
stateOrProvinceName = Bayern
localityName = Strunzenoed
organizationName = Example
organizationalUnitName = Example PKI
commonName = test.example.com
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Subject Key Identifier:
42:BE:22:33:44:CF:72:02:58:EB:EF:88:4B:BA:1C:10:B6:AA:DB:C8
X509v3 Authority Key Identifier:
FE:80:D7:E5:6D:27:9E:85:18:13:99:E5:79:B4:9E:CB:FA:42:21:F4
Authority Information Access:
CA Issuers - URI:https://pki.example.com/component-ca.cer
OCSP - URI:https://ocsp.example.com/component
X509v3 CRL Distribution Points:
Full Name:
URI:https://pki.example.com/component-ca.crl
X509v3 Subject Alternative Name:
DNS:test.example.com
Certificate is to be certified until Feb 23 21:25:10 2026 GMT (730 days)
Write out database with 1 new entries
Data Base UpdatedThis project is licensed under the MIT License.
- @jomrr (2022)