[openssl-users] Properly manage CA-signed certificates that have expired
warron.french at gmail.com
Thu Mar 31 15:16:10 UTC 2016
Hello, I had to build a Certificate Authority (CA) server for an isolated
network (I know, it seems silly).
Anyway, I figured out how to create the CA service doing a self-signed
certificate that will expire in 9 years, because it was a 10-year
certificate of which 9 years remains available.
I then created separate TLS keys and CSRs and had them signed by the CA
The 2 certificates for the "servers" (its actually all the same 1 server
with different DNS-A-Record resolvable names) worked perfectly for the past
1 year; but I was kept busy working on other tasks; so this isolated
network got neglected. The two (2) certificates for the servers expired
I documented how to build the CA, how to create the CSRs and get them
signed; but I didn't know how to write the documentation for maintaining
any certificates once they expired.
I want to properly, and gracefully, manage the CA server to do whatever is
I believe, but do not know for sure, that what I want to do is:
1. Revoke the expired certificates (maybe that is not necessary or
2. Clean up the CA database (with the openssl ca -updatedb command?)
3. Then create new server certificates for the 2 servers again.
I don't want to use the same 1 certificate for 2 services, because I have
one for TLS-securing the LDAP service making it an ldapS:// url, and the
other is for TLS-securing the AdminConsole of the same 389-ds
Please help, I don't know what terminology I am looking for to properly
pursue what a Professional CA (like Verisign, or wherever) would do.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the openssl-users