3 ms·
"CAs can sign any X.509 certificate." Please explain how a user who creates a CA pem file with openssl can sign the certificate from example.com. Not a faked
by pwdisswordfish2 6y ago
"CAs can sign any X.509 certificate."
Please explain how a user who creates a CA pem file with openssl can sign the certificate from example.com. Not a faked up certificate for example.com but the real one the owner of the example.com domain name got from Digicert.
- josephcsible 6y agoThis is the no true Scotsman fallacy. If I told you how to sign a certificate with your own CA, you'd tell me the result was "faked up".
- pwdisswordfish2 6y agoIf the owner of the example.com website creates the CSR and send its to the user, then the result is not "faked up". I use the term "faked up" only to refer to a scenario where the user generates a CSR for a domain name that is not under her control.
- josephcsible 6y agoFair enough. This command would do it then: openssl x509 -req -days 365 -in example.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out example.com.crt