Getting a passport for a web site
A shop wants a padlock on its web site. It cannot just make its own, because no browser would trust it. It must ask a trusted body.
There are four steps, and the order matters. You will do the first three yourself, with real tools, in a small safe copy of the real thing.
Key words
| Word | What it means |
|---|---|
| Key pair | A public key and a private key, made together. |
| Private key | The key you keep secret. |
| Public key | The key you share with everyone. |
| Certificate signing request | A file that asks a certificate authority for a certificate. Short form: CSR. |
| Certificate authority | A trusted body that signs certificates. Short form: CA. |
| Digital certificate | An electronic passport that proves who a device, server or user is. |
| Trust store | The list of authorities that a device already trusts. |
| Install | Put a certificate and its key where the server can use them. |
| Applicant | The person or company asking for a certificate. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can put the four steps of making a certificate in order and say who does each one.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Step 1: make a key pair
The applicant makes a key pair. The private key stays on the server and is never sent anywhere. The public key will go into the request.
Everything later depends on this private key staying secret.
Extra: Make a key pair
mkdir -p ~/certlab && cd ~/certlab && openssl genrsa -out shop.key 2048 && openssl rsa -in shop.key -pubout -out shop.pubA command for the lesson’s lab terminal. It is shown here and not run.
Read the result
The first command made shop.key, the private key. The second worked out shop.pub, the matching public key. OpenSSL may print writing RSA key. That is normal.
On the lab, the private key file is readable only by you. Keep it that way.
Step 2: make a certificate signing request
A certificate signing request, or CSR, is a file. It holds the public key and the details to go on the certificate, such as the name of the shop and its web address.
The request is signed with the private key to show that the applicant owns the pair. It is safe to send. It holds no secret.