Help with issuing self signed certificates

Hey guys,
I try to understand something about self signed certificates.
I generate a RSA key using openSSL.
Than I sign the key using the command:
openssl req -new -x509 -nodes -sha -days 365 -key key.pem -out
keyca.pem

my questions please:
1. does the new keyca.pem replaces the original key.pem file in my TLS
Server configuration Or do I need to configure both?
2. How do I make the clients trust my CA? I understand I need to
install the CA's public key for that. How do I create / find it from
openSSL?

This is a test setup, and I have full control on server AND clients
configurations.

I may have some bad assumptions on TLS. Please correct me if that's
true.

Thanks,
Asi.
.

Relevant Pages

  • Re: Help with issuing self signed certificates
    ... I generate a RSA key using openSSL. ... How do I make the clients trust my CA? ... OpenSSL comes with a simplistic script CA.sh (there's also a perl ... You also need a CA certificate, and a few files here and there for the ...
    (comp.security.misc)
  • [Full-Disclosure] Gentoo Linux Security Advisory 200403-03: Multiple OpenSSL Vulnerabilities
    ... Three vulnerabilities have been found in OpenSSL via a commercial test ... suite for the TLS protocol developed by Codenomicon Ltd. ... Testing performed by the OpenSSL group using the Codenomicon TLS ... with backported security patches. ...
    (Full-Disclosure)
  • Certificate problem in Radius with PEAP
    ... I want to set up a Radius server for use in 802.1x, ... openssl and I have generated a CA and signed a certificate with it, ... I attach the tls section ...
    (comp.os.linux.networking)
  • Re: recompile TLS with latest OpenSSL
    ... it appears we need to recompile the ... TLS with the latest OpenSSL for better security and function. ...
    (comp.lang.tcl)
  • Re: openssl with zlib support
    ... Are there any reason to not enabling zlib compression for TLS in openssl ... that seems like a mistake. ... Which FreeBSD version are you using, ...
    (freebsd-hackers)
Loading