++++++++++++++++++++++++++++++++++++++++++++++
+ Create Root CA                             +
++++++++++++++++++++++++++++++++++++++++++++++

1. Create the root key
  # cd /root/ca
  # openssl genrsa -aes256 -out private/ca.key.pem 4096

    Enter pass phrase for ca.key.pem: senthink123iot
    Verifying - Enter pass phrase for ca.key.pem: senthink123iot

  # chmod 400 private/ca.key.pem

2. Create the root certificate
  # cd /root/ca
  # openssl req -config openssl.cnf -key private/ca.key.pem -new -x509 -days 36500 -sha256 -extensions v3_ca -out certs/ca.cert.pem

    Country Name (2 letter code) [CN]:
    State or Province Name [Zhejiang]:
    Locality Name [Hangzhou]:
    Organization Name [Senthink Ltd]:
    Organizational Unit Name [Senthink Ltd Certificate Authority]:
    Common Name []:Senthink Ltd Root CA
    Email Address [Dash@senthink.com]:

  # chmod 444 certs/ca.cert.pem

3. Verify the root certificate
  # openssl x509 -noout -text -in certs/ca.cert.pem


++++++++++++++++++++++++++++++++++++++++++++++
+ Create the intermediate pair               +
++++++++++++++++++++++++++++++++++++++++++++++
0. Prepare the directory
  # mkdir /root/ca/intermediate && cd /root/ca/intermediate
  # mkdir certs crl csr newcerts private && chmod 700 private && touch index.txt && echo 1000 > serial
  # echo 1000 > /root/ca/intermediate/crlnumber

1. Create the intermediate key
  # cd /root/ca
  # openssl genrsa -aes256 -out intermediate/private/intermediate.key.pem 4096

    Generating RSA private key, 4096 bit long modulus
    ...........................................................................++
    .........................++
    e is 65537 (0x10001)
    Enter pass phrase for intermediate/private/intermediate.key.pem:senthink123iot
    Verifying - Enter pass phrase for intermediate/private/intermediate.key.pem:senthink123iot

  # chmod 400 intermediate/private/intermediate.key.pem

2. Create the intermediate certificate
  # cd /root/ca
  # openssl req -config intermediate/openssl.cnf -new -sha256 -key intermediate/private/intermediate.key.pem -out intermediate/csr/intermediate.csr.pem
    Enter pass phrase for intermediate/private/intermediate.key.pem:senthink123iot
    -----
    Country Name (2 letter code) [CN]:
    State or Province Name [Zhejiang]:
    Locality Name [Hangzhou]:
    Organization Name [Senthink Ltd]:
    Organizational Unit Name [Senthink Ltd Certificate Authority]:
    Common Name []:Senthink Ltd Intermediate CA
    Email Address [Dash@senthink.com]:

  # cd /root/ca
  # openssl ca -config openssl.cnf -extensions v3_intermediate_ca -days 32850 -notext -md sha256 -in intermediate/csr/intermediate.csr.pem -out intermediate/certs/intermediate.cert.pem

    Enter pass phrase for ca.key.pem: senthink123iot
    Sign the certificate? [y/n]:y
    1 out of 1 certificate requests certified, commit? [y/n]y
    Write out database with 1 new entries
    Data Base Updated

  # chmod 444 intermediate/certs/intermediate.cert.pem

3. Verify the intermediate certificate
  # openssl x509 -noout -text -in intermediate/certs/intermediate.cert.pem
  # openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate.cert.pem
   
    intermediate.cert.pem: OK

4. Create the certificate chain file
  # cat intermediate/certs/intermediate.cert.pem certs/ca.cert.pem > intermediate/certs/ca-chain.cert.pem
  # chmod 444 intermediate/certs/ca-chain.cert.pem


++++++++++++++++++++++++++++++++++++++++++++++
+ Sign server certificates                   +
++++++++++++++++++++++++++++++++++++++++++++++
1. Create a key
  # cd /root/ca
  # openssl genrsa -aes256 -out intermediate/private/server.key.pem 2048
    Generating RSA private key, 2048 bit long modulus
    ..........................................................+++
    ....+++
    e is 65537 (0x10001)
    Enter pass phrase for intermediate/private/server.key.pem:iot123server

  # chmod 400 intermediate/private/server.key.pem

2. Create a certificate
  # cd /root/ca
  # openssl req -config intermediate/openssl.cnf -key intermediate/private/server.key.pem -new -sha256 -out intermediate/csr/server.csr.pem
    Enter pass phrase for intermediate/private/server.key.pem:iot123server
    -----
    Country Name (2 letter code) [CN]:
    State or Province Name [Zhejiang]:
    Locality Name [Hangzhou]:
    Organization Name [Senthink Ltd]:
    Organizational Unit Name [Senthink Ltd Certificate Authority]:Senthink Ltd IoT Platform Services
    Common Name []:iot.senthink.com                
    Email Address [Dash@senthink.com]:

  # cd /root/ca
  # openssl ca -config intermediate/openssl.cnf -extensions server_cert -days 29200 -notext -md sha256 -in intermediate/csr/server.csr.pem -out intermediate/certs/server.cert.pem
  # chmod 444 intermediate/certs/server.cert.pem

3. Verify the certificate
  # openssl x509 -noout -text -in intermediate/certs/server.cert.pem
  # openssl verify -CAfile intermediate/certs/ca-chain.cert.pem intermediate/certs/server.cert.pem

    server.cert.pem: OK


++++++++++++++++++++++++++++++++++++++++++++++
+ Sign client certificates                   +
++++++++++++++++++++++++++++++++++++++++++++++
1. Create a key
  # cd /root/ca
  # openssl genrsa -aes256 -out intermediate/private/client.key.pem 2048
    Generating RSA private key, 2048 bit long modulus
    ..........................................................+++
    ....+++
    e is 65537 (0x10001)
    Enter pass phrase for intermediate/private/client.key.pem:iot123client

  # chmod 400 intermediate/private/client.key.pem

2. Create a certificate
  # cd /root/ca
  # openssl req -config intermediate/openssl.cnf -key intermediate/private/client.key.pem -new -sha256 -out intermediate/csr/client.csr.pem
    Enter pass phrase for intermediate/private/client.key.pem:iot123client
    -----
    Country Name (2 letter code) [CN]:
    State or Province Name [Zhejiang]:
    Locality Name [Hangzhou]:
    Organization Name [Senthink Ltd]:
    Organizational Unit Name [Senthink Ltd Certificate Authority]:Senthink Ltd IoT Platform Services
    Common Name []:node.iot.senthink.com                
    Email Address [Dash@senthink.com]:

  # cd /root/ca
  # openssl ca -config intermediate/openssl.cnf -extensions usr_cert -days 29200 -notext -md sha256 -in intermediate/csr/client.csr.pem -out intermediate/certs/client.cert.pem
  # chmod 444 intermediate/certs/client.cert.pem

3. Verify the certificate
  # openssl x509 -noout -text -in intermediate/certs/client.cert.pem
  # openssl verify -CAfile intermediate/certs/ca-chain.cert.pem intermediate/certs/client.cert.pem

    client.cert.pem: OK























