User's Manual

Table Of Contents
Secure Socket Protocol Theory of Operation
AT+i Programmer‘s Manual Version 8.32 32-3
[ CA_default_policy ]
commonName = supplied
stateOrProvinceName = supplied
countryName = supplied
emailAddress = supplied
organizationName = supplied
organizationalUnitName = optional
[ certificate_extensions ]
basicConstraints = CA:false
[ req ]
dir = /testCA
default_bits = 1024
default_keyfile = $dir/private/caprivkey.pem
default_md = md5
prompt = no
distinguished_name = root_ca_DN
x509_extensions = root_ca_extensions
[ root_ca_DN ]
commonName = Common Name # Server name or YOUR name
stateOrProvinceName = My State
countryName = US # 2 Letter Code
emailAddress = myemail@mydomain.com # Your Email Address
organizationName = My Organization
organizationalUnitName = Organization Unit # Unit Name (ie, section)
[ root_ca_extensions ]
basicConstraints = CA:true
Note that both dir entries under [CA_default] and [req] must be set to the path to the
testCA directory created earlier. The root_ca_DN section can be changed to enter
information specific to your organization.
32.4.3 Creating a Self-Signed Root Certificate
A certificate authority is essentially a self-signed root certificate. This root certificate is
used to respond to new certificate requests to create a signed certificate. In this case,
iChip is both the CA and the originator of the certificate request, so no identity
verification issues exist. In a more typical situation, however, a CA can only be trusted if
it performs sufficient background checks into the originator of the certificate request to
verify its identity.
1. Set the OPENSSL_CONF system environment variable to point to the newly created
configuration file.
On Linux\Unix, type the following:
OPENSSL_CONF=/testCA/CAcnf.ca
export OPENSSL_CONF
On Windows, type the following:
set OPENSSL_CONF=C:\testCA\CAcnf.ca