{"id":2925,"date":"2018-11-13T11:32:07","date_gmt":"2018-11-13T11:32:07","guid":{"rendered":"http:\/\/blog.designed79.co.uk\/?p=2925"},"modified":"2019-01-21T10:37:10","modified_gmt":"2019-01-21T10:37:10","slug":"renew-root-ca-cert-made-with-certificate-assistant-on-macos","status":"publish","type":"post","link":"https:\/\/blog.designed79.co.uk\/?p=2925","title":{"rendered":"Renew Root CA Cert made with Certificate Assistant on macOS"},"content":{"rendered":"

NOTE : a good open source cross platform CA is xca,\u00a0https:\/\/github.com\/chris2511\/xca<\/strong><\/p>\n

Basically, you can create a new CA using the same private key and subject from the old CA. You replace the old CA certificate with the new one in Keychain Access. Finally, you continue creating or signing certificates in the normal way using Certificate Assistant.<\/p>\n

Please try these steps using a test CA first. Make sure they work as expected with the test CA. That way if anything goes wrong, you won’t have affected your actual CA. Make a backup copy of your old CA before making any changes to it. Let me know if you have any questions.<\/p>\n

Note: These instructions assume you need to renew a root CA and not an intermediate CA.<\/p>\n

Procedure:<\/p>\n

1. In Keychain Access, export your CA’s certificate as “old.cer”.<\/p>\n

2. Convert the old CA certificate to a new PEM format file “old.crt”:<\/p>\n

openssl x509 -inform der -in old.cer -out old.crt<\/p>\n

3. In Keychain Access, export your CA’s private key as “old.p12”.
\nThis will require you to set a passphrase to protect the exported file.<\/p>\n

4. Convert the old CA private key to a new PEM format file “old.key”:<\/p>\n

openssl pkcs12 -in old.p12 -out old.key<\/p>\n

5. Make a backup of your old CA, including the old.* files and all files here:<\/p>\n

~\/Library\/Application Support\/Certificate Authority\/Name of CA<\/p>\n

6. Create an openssl.cnf file with settings that match your old CA cert.
\nHere is a minimal example:<\/p>\n

[ req ]
\ndistinguished_name = req_distinguished_name
\n[ req_distinguished_name ]
\n[ v3_ca ]
\nbasicConstraints = critical, CA:TRUE
\nkeyUsage = critical, keyCertSign, keyEncipherment, digitalSignature
\nextendedKeyUsage = critical, serverAuth<\/p>\n

or<\/p>\n

[ req ]
\ndistinguished_name = req_distinguished_name
\n[ req_distinguished_name ]
\n[ v3_ca ]
\nbasicConstraints = critical, CA:TRUE
\nkeyUsage=critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign
\nextendedKeyUsage=critical, emailProtection, clientAuth, serverAuth, codeSigning, 1.3.6.1.5.2.3.4, 1.3.6.1.5.2.3.5, 2.5.29.37.0<\/p>\n

You may need to change the keyUsage and extendedKeyUsage lines to match your old CA. See the x509v3_config(5) man page for more info.<\/p>\n

7. Get the subject string from the old CA cert with this command:<\/p>\n

openssl x509 -noout -subject -in old.crt<\/p>\n

It should be a single line this:<\/p>\n

CN=My Example CA, C<\/a>=US\/emailAddress=user@example.com<\/p>\n

You may have more fields in your subject for city, organization, etc. You’ll use this in the next step when creating a CSR for the new CA. \u00a0Ignore the subject=<\/strong> part<\/p>\n

8. Create a new signing request using the old CA’s key and the openssl.cnf
\nfile created in the last step:<\/p>\n

openssl req -config openssl.cnf -extensions v3_ca -new -key old.key -sha256 -out new.csr -subj “SUBJECT_STRING_FROM_PREVIOUS_STEP”<\/p>\n

9. Sign the new CA certificate using your old CA’s key:<\/p>\n

openssl x509 -req -extfile openssl.cnf -extensions v3_ca -days 365 -in new.csr -signkey old.key -sha256 -out new.crt<\/p>\n

Note that you can change the “-days” option if 365 days isn’t enough time before the CA cert expires. 7250 is about the max you can use<\/p>\n

Also note this will create a random serial number for the new cert which shouldn’t interfere with serial numbers used by any of your existing signed certs.<\/p>\n

10. Find an old certificate that you signed with your old CA. Verify the certificate using your old and new CA certs:<\/p>\n

openssl verify -CAfile old.crt -verbose some_old_cert.crt
\nopenssl verify -CAfile new.crt -verbose some_old_cert.crt<\/p>\n

Do not proceed unless both report “OK”. If the new one doesn’t say “OK”, something went wrong.<\/p>\n

11. Drag new.crt into Keychain Access. You will now have two identically named certificates which share the same private key. You will be able to tell which one is newer by the “Expires” column.<\/p>\n

12. Delete the old root CA cert in Keychain Access. DO NOT delete its private key, since it is now the private key for the new CA cert.<\/p>\n

13. Continue using the CA through Certificate Assistant as before. Test this by signing some new certificates.<\/p>\n","protected":false},"excerpt":{"rendered":"

NOTE : a good open source cross platform CA is xca,\u00a0https:\/\/github.com\/chris2511\/xca Basically, you can create a new CA using the same private […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2925","post","type-post","status-publish","format-standard","hentry","category-info-on-tech"],"_links":{"self":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/2925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2925"}],"version-history":[{"count":0,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/2925\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}