3

I'm currently porting a script which generates an SSL key from a Windows CA (which usually runs using Microsoft Windows) to Ubuntu. Unfortunately, I've been unable to find a substitute for the Windows application certreq.

My script currently looks like this:

# Generate keystore with name ssl, write to cert.jks
keytool -genkey -dname "CN=my.host.bla, OU=[...], O=[...], L=[...], S=BY, C=DE" -alias ssl -keyalg RSA -keysize 2048 -keystore cert.jks

# gen CSR into my.host.bla.csr
keytool -certreq -keyalg RSA -alias ssl -file my.host.bla.csr -keystore cert.jks -ext san=DNS:my.host.bla

# submit CSR to CA (this is a windows-specifc part!!)
certreq -submit -attrib "certificatetemplate:ssl201610" my.host.bla.csr

# Import Issuers
# Root-CA: (already downloaded)
keytool -import -alias root-pki -keystore cert.jks -trustcacerts -file "blaRootCA.cer"

# Intermedi / Issuer-CA: (already downloaded)
keytool -import -alias issuing-pki -keystore cert.jks -trustcacerts -file "blaIssuingCA.cer"

# Import keys
keytool -import -alias ssl -keystore cert.jks -file my.host.bla.cer

The sole remaining question is: Is there an application which replaces certreq?

Everything else works fine

3
  • 1
    There is the Web Enrollment interface, but you should consider security before installing that on an Enterprise CA. – garethTheRed Sep 27 '16 at 18:43
  • @garethTheRed thanks for you input, unluckily the web enrollment interface is not feasible here. – Robert Heine Sep 28 '16 at 6:02
  • 1
    certutil uses Microsoft's own WCCE protocol for enrollment. As far as I'm aware, there is no Linux client. – garethTheRed Sep 28 '16 at 6:38
1

Unluckily there's really no client for that in linux, while the web interface might be a solution (for others), the most simple way is:

  • moving the csr into a windows-based host
  • doing the certreq step
  • moving the certificate back to a linux-based host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.