Create an intermediate certificate instance using OpenSSL

1. Issue the Root CA
OpenSSL genrsa-des3-out myrootca. Key 1024
OpenSSL req-New-key myrootca. Key-out myrootca. req
OpenSSL X509-req-days 7305-extfile rootca. conf-signkey myrootca. Key-In myrootca. req-out myrootca. CRT
2. Issue intermediate ca
OpenSSL genrsa-out subca. Key 1024
OpenSSL req-New-key subca. Key-out subca. req
OpenSSL X509-req-days 3650-sha1-extfile subca. conf-Ca myrootca. CRT-Cakey myrootca. key-caserial myrootca. SRL-cacreateserial-In subca. REQ-out subca. CRT
1. Use an intermediate CA to issue a server certificate

OpenSSL X509-req-days 3650-sha1-extfile server. conf-Ca subca. CRT-Cakey subca. Key-caserial subca. SRL-cacreateserial-In certreq.txt-out serverbysubca. CRT

1. Use the Root CA to issue a server certificate
OpenSSL X509-req-days 3650-sha1-extfile server. conf-Ca myrootca. CRT-Cakey myrootca. key-caserial myrootca. SRL-cacreateserial-In myhost. REQ-out myhost. CRT

Rootca. conf:

Basicconstraints = Ca: True
Keyusage = keycertsign, crlsign

Subca. conf

Basicconstraints = Ca: True, pathlen: 0

Keyusage = keycertsign, crlsign

Nscerttype = sslca, emailca, objca

Server. conf

 

Basicconstraints = Ca: false

Keyusage = digitalsignature, keyencipherment, dataencipherment, keyagreement

Nscerttype = Server

Extendedkeyusage = serverauth, mssgc, nssgc