Cfssl Cheatsheat

📆: 08 Feb 2023
🏷: Pki, Selfhosting

Generate new Server Certificates

Generate CSR, certificate and private key for fqdn:

fqdn=host.domain.tld
cfssl gencert -ca intermediate/intermediate_ca.pem \
  -ca-key intermediate/intermediate_ca-key.pem \
  -config config.json \
  -profile server certificates/${fqdn}.json | cfssljson -bare certificates/${fqdn}

Generate chain

cat certificates/${fqdn}.pem intermediate/intermediate_ca.pem > certificates/${fqdn}-full.pem

Generate PKCS#12

openssl pkcs12 -export \
  -in certificates/${fqdn}.pem \
  -inkey certificates/${fqdn}-key.pem \
  -out certificates/${fqdn}.p12 \
  -name ${fqdn} \
  -CAfile brank.pem \
  -chain

Convert to Java Keystore

keytool -importkeystore \
  -deststorepass changeit \
  -destkeypass changeit \
  -destkeystore foo.keystore \
  -srckeystore certificates/${fqdn}.p12 \
  -srcstoretype PKCS12 \
  -srcstorepass password \
  -alias fqdn

Cleaning up
```
unset fqdn
```

Renew expired intermediate CA certificate

New CSR

cfssl gencsr -key intermediate/intermediate_ca-key.pem \
	intermediate/intermediate-ca.json  |\
	cfssljson -bare intermediate/intermediate_ca

Sign CSR

cfssl sign -ca root/ca.pem \
	-ca-key root/ca-key.pem \
	-config config.json \
	-profile intermediate_ca \
	intermediate/intermediate_ca.csr |\
	cfssljson -bare /tmp/intermediate_ca

Recreate chain

fqdn=relayd.rand.clacks.xyz
cat certificates/${fqdn}.pem intermediate/intermediate_ca.pem > certificates/${fqdn}-full.pem

Cleanup environment
```
unset fqdn
```

Renew expired server certificate

Set variable to make our life easier
```
fqdn=host.domain.tld
```

New CSR

cfssl gencsr -key certificates/${fqdn}-key.pem \
  certificates/${fqdn}.json |\
  cfssljson -bare certificates/${fqdn}

Sign CSR

cfssl sign -ca intermediate/intermediate_ca.pem \
	-ca-key intermediate/intermediate_ca-key.pem \
	-config config.json \
	-profile server \
	certificates/${fqdn}.csr |\
	cfssljson -bare certificates/${fqdn}

Recreate chain

cat certificates/${fqdn}.pem intermediate/intermediate_ca.pem > certificates/${ …

Full article →