Create, sign and deploy certificates in Ubuntu 14 system using certtool

Question

I'm trying to learn about certificate generation, signing and what it takes to become a CA.

I am developing a HTTP proxy, which will be a middle proxy between browser and actual web server, and it will be used to record the HTTPS messages send received between browser and actual web server.

I need to generate dynamic certificates for domains browsed in browser in HTTP proxy that I am developing in a Ubuntu 14 64 bit machine. I want chrome should work smoothly while browsing various sites.

What I have done so far:

1. Created key and self signed certificate for CA using below commands.

   certtool --generate-privkey --outfile ca-key.pem
   certtool --generate-self-signed --template cert.cfg --load-privkey ca-key.pem --outfile ca-cert.pem
   

2. Explicitly set ca certificate in system cert store.

3. Converted pem to crt certificate using below command

   openssl x509 -in ca-cert.pem -inform PEM -out ca-cert.crt
   

   (I need to find the corresponding command in certtool)

4. Then copied ca-cert.crt file to /usr/share/ca-certificates/extra path and executed below command to set ca certificate in system explicitly.

   sudo dpkg-reconfigure ca-certificates
   

   With this I get a system window, I select ca-cert.crt and press Ok to set certificate explicitly in system. My understanding is that since ca-cert.crt is set in system explicitly any other certificates signed by this ca-cert and ca-key will be trusted in system (except applications using their own cert store like firefox).

5. Next I created key for HTTP proxy using below command:

   certtool --generate-privkey --outfile key.pem
   

6. Then I created csr for HTTP proxy using below command.

   certtool --generate-request --load-privkey key.pem --template cert.cfg --outfile request.pem*
   

7. Then I signed the csr using below command.

   certtool --generate-certificate --load-request request.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template cert.cfg --outfile cert.pem
   

Finally I have cert.key and cert.pem. Now these certificate files are used for communication between browser and my HTTP proxy.

I see that Chrome does not show the contents received. However if I start Chrome with ignore-certificate-errors mode, then Chrome works fine and shows the content in site properly.

Can somebody guide me as to what I'm doing wrong that's causing Chrome not to show the contents received?

Answer 1

Did you have a look at the template file cert.cfg? That same file name occurs in two different calls of certtool, where the purposes of the calls are complementary to one another.

Check that the template is the same in both cases. In particular you should pay attention to the ca-instruction in each file to make sure they match.