<p>I am running a number of SSL-encrypted websites, and need to generate certificates to run on these. They are all internal applications, so I don't need to purchase a certificate, I can create my own.</p>

<p>I have found it quite tedious to do everything using openssl all the time, and figure this is the kind of thing that has probably been done before and software exists for it.</p>

<p>My preference is for linux-based systems, and I would prefer a command-line system rather than a GUI.</p>

<p>Does anyone have some suggestions?</p>

[{'answer_id': 18237, 'author': 'T Percival', 'author_id': 954, 'author_profile': 'https://Stackoverflow.com/users/954', 'pm_score': 3, 'selected': False, 'text': '<p>An option that doesn\'t require your own CA is to get certificates from <a href="http://www.cacert.org/" rel="noreferrer">CAcert</a> (they\'re free).</p>\n\n<p>I find it convenient to add the two CAcert root certificates to my client machines, then I can manage all the SSL certificates through CAcert.</p>\n'}, {'answer_id': 31560, 'author': 'paan', 'author_id': 2976, 'author_profile': 'https://Stackoverflow.com/users/2976', 'pm_score': 3, 'selected': False, 'text': '<p>It\'s likely that self-signing will give you what you need; <a href="http://web.archive.org/web/20080221140348/http://riseuplabs.org/grimoire/web-server/self-signed-certs/" rel="nofollow noreferrer">here is a page</a> (link resurrected by web.archive.org) that provides a decent guide to self-signing if you would like to know the ins and outs of how it\'s done and how to create your own script.</p>\n\n<p>The original script link from this response is unfortunately dead and I was unable to find an archive of it, but there are many alternatives for pre-rolled shell scripts out there.</p>\n\n<p>If you\'re looking for something to support fairly full-featured self-signing, then <a href="http://www.webcitation.org/query?url=http%3A%2F%2Ftldp.org%2FHOWTO%2F8021X-HOWTO%2Fcert.html&amp;date=2012-04-29" rel="nofollow noreferrer">this guide for 802.1x authentication</a> from tldp.org recommends using the helper scripts for self-signing from <a href="http://freeradius.org/download.html" rel="nofollow noreferrer">FreeRADIUS</a>. Or, if you just need quick-and-dirty, then Ron Bieber offers up his <a href="http://www.webcitation.org/query?url=http%3A%2F%2Fwww.bieberlabs.com%2Farchives%2F2005%2F12%2F06%2Fcreating-a-self-signed-ssl-certificate-a-brain-dead-script%2F&amp;date=2012-04-29" rel="nofollow noreferrer">"brain-dead script"</a> for self-signing on his blog at bieberlabs.com. </p>\n\n<p>Of course there are many alternative scripts out there but this seems to give a good range of choices, and with a little additional info from the guide you should be able to tailor these to do whatever you need.</p>\n\n<p>It\'s also worth checking the <a href="http://www.tldp.org/HOWTO/SSL-Certificates-HOWTO/" rel="nofollow noreferrer">SSL Certificates HOWTO</a>. It\'s quite old now (last updated 2002) but its content is still relevant: it explains how to use the <code>CA</code> Perl / Bash script provided with OpenSSL software.</p>\n'}, {'answer_id': 48540, 'author': 'sherbang', 'author_id': 5026, 'author_profile': 'https://Stackoverflow.com/users/5026', 'pm_score': 3, 'selected': False, 'text': '<p>I know you said you prefer the command line, but for others who are interested in this, <a href="http://tinyca.sm-zone.net/" rel="noreferrer" title="TinyCA">TinyCA</a> is a very easy to use GUI CA software.  I have used this both in Linux, and also in OSX.</p>\n'}, {'answer_id': 1416587, 'author': 'user172649', 'author_id': 172649, 'author_profile': 'https://Stackoverflow.com/users/172649', 'pm_score': 1, 'selected': False, 'text': '<p>There\'s a simple webpage solution: <a href="https://www.ibm.com/developerworks/mydeveloperworks/blogs/soma/entry/a_pki_in_a_web_page10" rel="nofollow noreferrer">https://www.ibm.com/developerworks/mydeveloperworks/blogs/soma/entry/a_pki_in_a_web_page10</a></p>\n'}, {'answer_id': 9258731, 'author': 'Thomas', 'author_id': 1206532, 'author_profile': 'https://Stackoverflow.com/users/1206532', 'pm_score': 1, 'selected': False, 'text': '<p>I like to use the easy-rsa scripts provided with OpenVPN. This is a collection of command line tools used to create the PKI environment required for OpenVPN.\nBut with a slight change of the (also provided) openssl.cnf file you can create pretty much anything you want with it.\nI use that for self signing ssl server certificates as well as with Bacula backup and for creating private keys/csr\'s for "real" certificates.\njust download the OpenVPN community edition source tarball and copy the easy-rsa folder to your linux machine. you\'ll find lots of documentation on the openvpn community pages.</p>\n\n<p>I used to use CAcert, it\'s also nice, but you have to create the CSR yourself, so you have to use openssl again and the certs aer only valid for half a year. this is annoying</p>\n'}, {'answer_id': 16231497, 'author': 'Emmanuel Touzery', 'author_id': 516188, 'author_profile': 'https://Stackoverflow.com/users/516188', 'pm_score': 2, 'selected': False, 'text': '<p>The XCA software appears reasonably well maintained (copyright 2012, uses Qt4), with a well-documented and simple enough user interface and has packages on debian, ubuntu and fedora.</p>\n\n<p>Don\'t judge the website at first sight:\n<a href="http://xca.sourceforge.net/" rel="nofollow">http://xca.sourceforge.net/</a></p>\n\n<p>Rather, check this nice walkthrough to add a new CA:\n<a href="http://xca.sourceforge.net/xca-14.html#ss14.1" rel="nofollow">http://xca.sourceforge.net/xca-14.html#ss14.1</a></p>\n\n<p>You can see a screenshot of the application there: <a href="http://sourceforge.net/projects/xca/" rel="nofollow">http://sourceforge.net/projects/xca/</a></p>\n\n<p>It is GUI-based though, not command-line.</p>\n'}, {'answer_id': 28095604, 'author': 'brianclements', 'author_id': 2607578, 'author_profile': 'https://Stackoverflow.com/users/2607578', 'pm_score': 0, 'selected': False, 'text': '<p>I created <a href="https://github.com/brianclements/pkictl" rel="nofollow">a wrapper script</a>, written in Bash, for OpenSSL that might be useful to you here. To me, the easiest sources of user error when using OpenSSL were:</p>\n\n<ol>\n<li>Keeping a consistent and logical naming scheme for configuration/certs/keys so that I can see how every artifact fits into the entire PKI by just looking at the file name/extension</li>\n<li>Enforcing a folder structure thats consistent across all CA machines that use the script.</li>\n<li>Specifying too many configuration options via CLI and loosing track of some of the details</li>\n</ol>\n\n<p>The strategy is to push all configuration into their own files, saving only execution of a particular action for the CLI. The script also strongly enforces the use of a particular naming scheme for folders/files here which is helpful when looking at any single file.</p>\n\n<p>Use/Fork/PR away! Hope it helps.</p>\n'}]
['https://Stackoverflow.com/questions/17781', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/277/']