Generate a certificate issued by own CA (see the script below)
Here's what I've found. Correct me where I'm wrong.
There are CA's (certificate authorities). They issue certificates (sign CSR's) for other CA's (intermediate CA's), or servers (end entity certificates). Some of them are root authorities. They have self-signed certificates, issued by themselves. That is, usually there's a chain of trust that goes from server certificate to root certificate. And there's noone to vouch for a root certicate. As such, OS'es have a root certificate store (or trust policy store), a systemwide list of trusted root certificates. Browsers have their own lists of trusted certificates, which consist of systemwide list plus certificates trusted by the user.
In Chromium you manage certificates at chrome://settings/certificates. In Firefox, Preferences > Privacy & Security > Certificates > View Certificates. Both have Authorities tab, which is a list of trusted root certificates. And Servers tab, a list of trusted server certificates.
To obtain a certificate you create CSR (certificate signing request), send it to CA. CA signs the CSR, turning it into trusted certificate in the process.
Certificates and CSR's are a bunch of fields with information plus public key. Some of the fields are called extensions. CA certificate is a certificate with "basicConstraints = CA:true".
You can inspect certificate errors in Chromium in Developer Tools > Security.
##### Trusting certificates systemwide
When you change OS' root certificate store, you've got to restart a browser. You change it with:
```
# trust anchor path/to/cert.crt
# trust anchor --remove path/to/cert.crt
```
`trust` puts CA certificates under "authority" category (`trust list`), or "other-entry" category otherwise. CA certificates appear in Authorities tab in browsers, or else in Servers tab.
##### Trusting certificates in a browser
In Chromium, and Firefox you can add (import) certificates to Authorities tab. If you try to import a non-CA certificate, you get "Not a Certificate Authority" message. After choosing a file, a dialog appears where you can specify trust settings (when to trust the certificate). The relevant setting for making a site work is "Trust this certificate for identifying websites."
In Chromium, you can add (import) certificates on Servers tab. But they end up either on Authorities tab (CA certificates, and you're not presented with trust settings dialog after choosing a file), or on Others tab (if non-CA certificate).
In Firefox, you can't exactly add a certificate to Servers tab. You add exceptions. And you can trust a certificate with no extensions at all there.
##### Self-signed certificate extensions
My system comes with the following default settings (extensions to be added) for certificates:
```
basicConstraints = critical,CA:true
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
```
Taken from /etc/ssl/openssl.cnf, section v3_ca. More on it [here](https://jlk.fjfi.cvut.cz/arch/manpages/man/core/openssl/x509v3_config.5ssl.en).
Additionally, Chromium considers a certificate invalid, when it doesn't have:
```
subjectAltName = DNS:$domain
```
##### Non-self-signed certificate extensions
From section [ usr_cert ] of /etc/ssl/openssl.cnf:
```
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
```
##### When browsers trust a self-signed certificate
For Chromium to trust to a self-signed certificate it's got to have "basicConstraints = CA:true", and "subjectAltName = DNS:$domain". For Firefox not even this is enough:
```
basicConstraints = critical,CA:true
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
subjectAltName = DNS:$domain
```
##### When browsers trust a certificate issued by own CA
Firefox needs no extensions, but Chromium requires subjectAltName.
Without `-subj` it will ask questions regarding distinguished name (DN), like common name (CN), organization (O), locality (L). You can answer them "in advance": `-subj "/CN=$domain/O=$org"`.
To add subjectAltName extension, you've got to either have a config where it all is specified, or add a section to config and tell openssl its name with `-extensions` switch:
```
-config <(cat /etc/ssl/openssl.cnf - <<END
[ x509_ext ]
basicConstraints = critical,CA:true
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
subjectAltName = DNS:$domain
END
) -extensions x509_ext
```
`openssl req -new -key "$domain".key -out "$domain".csr` - generate [CSR](https://jlk.fjfi.cvut.cz/arch/manpages/man/core/openssl/req.1ssl.en), it can take `-subj` option
Doesn't work without `-CAcreateserial`. It creates a ca.srl file, where it keeps serial number of the last generated certificate. To add subjectAltName, you're gonna need `-extfile` switch:
