Help with issuing self signed certificates

Hey guys,
I try to understand something about self signed certificates.
I generate a RSA key using openSSL.
Than I sign the key using the command:
openssl req -new -x509 -nodes -sha -days 365 -key key.pem -out
keyca.pem

my questions please:
1. does the new keyca.pem replaces the original key.pem file in my TLS
Server configuration Or do I need to configure both?
2. How do I make the clients trust my CA? I understand I need to
install the CA's public key for that. How do I create / find it from
openSSL?

This is a test setup, and I have full control on server AND clients
configurations.

I may have some bad assumptions on TLS. Please correct me if that's
true.

Thanks,
Asi.
.

Relevant Pages

  • Re: SSL problem/help
    ... Wheezy has OpenSSL 1.0.1 which introduces ... new TLS protocols ... The server seems to be unable to cope with those new protocols. ... I am guessing there is slight problem with the cert at ...
    (Debian-User)
  • Re: Help with issuing self signed certificates
    ... I generate a RSA key using openSSL. ... How do I make the clients trust my CA? ... OpenSSL comes with a simplistic script CA.sh (there's also a perl ... You also need a CA certificate, and a few files here and there for the ...
    (comp.security.misc)
  • [Full-Disclosure] Gentoo Linux Security Advisory 200403-03: Multiple OpenSSL Vulnerabilities
    ... Three vulnerabilities have been found in OpenSSL via a commercial test ... suite for the TLS protocol developed by Codenomicon Ltd. ... Testing performed by the OpenSSL group using the Codenomicon TLS ... with backported security patches. ...
    (Full-Disclosure)
  • Re: OpenSSL and Heimdal
    ... OpenSSL doesn't and doesn't show any signs of doing so in the near ... TLS/DTLS heartbeat support. ... RFC 5705 TLS key material exporter. ... Preliminary FIPS capability for unvalidated 2.0 FIPS module. ...
    (FreeBSD-Security)
  • Certificate problem in Radius with PEAP
    ... I want to set up a Radius server for use in 802.1x, ... openssl and I have generated a CA and signed a certificate with it, ... I attach the tls section ...
    (comp.os.linux.networking)