Setting-up a Certificates Authority using OpenSSL

I forget this almost everytime, so write it down here just in case.

1. Have OpenSSl install somewhere.
2. Go to /share/ssl or sometimes ssl directory
3. Fix openssl.conf. Change "demoCA" to "somethingCA" that's more appropriate.
4. Change "-days 365" in misc/CA.sh to "-days 3650"
5. misc/CA.sh -newca. A directory called "somethingCA" will be here.
6. Now create a cert request
1. misc/CA.sh -newreq for cert with passphrase
   
2. To create a cert request without passphrase. "openssl genrsa -out newkey.pem 1024" then "openssl req -new -key newkey.pem -out newreq.pem"
   
7. Sign the generated request with "misc/CA.sh -sign". It always looking for "newreq.pem" so be carefull. The new certificates will be in newcert.pem
8. Copy key and cert to the machine which want to use these. Put it in appropriate directory (/usr/share/ssl/certs/{slapd-key.pem,slapd.pem} for OpenLDAP)
9. Find the hash number of ca by "misc/c_hash somethingCA/cacert.pem". The printed value is the file name. Copy somethingCA/cacert.pem to /usr/share/ssl/certs/.0.
   

For OpenLDAP

1. Need to fix /etc/openldap/ldap.conf and /etc/openldap/slapd.conf to accept the new CA
2. Fix the following configuration
1. "TLS_CACERT /usr/share/ssl/certs/fde68c33.0" in /etc/openldap/ldap.conf
2. "TLSCACertificateFile /usr/share/ssl/certs/fde68c33.0" in /etc/openldap/slapd.conf

Hope that I'll never forget this again.