How to Create a Minimally Viable Private CA for Jar Signing using OpenSSL

Sometimes it is not possible to buy the expensive HSHSM-based solution for EBS Jar signing. You can use your own private CA for signing the jar files.

This post gives an overview of creating private CA using OpenSSL command.

Table of Contents

One-Time CA Initialization

Create CA Directory

mkdir ~/ebsJarCA
cd ~/ebsJarCA

Create CA Directory Structure

mkdir certs db private
chmod 700 private
touch db/index
openssl rand -hex 16 > db/serial
echo 1001 > db/crlnumber

Create a CA Configuration File

Put the host, domain, port and organization information in the respective section. . if you are going to host the CRL on EBS make sure to use the PRODUCTION URL as that server will be up most of the time

cat > ebsca.conf <<-'EOF'
[default]
name = ebsca
host = <Host for the CRL file>
domain_suffix = <Domain for the CRL file >
port = <HTTP PORT>
aia_url = http://$host.$domain_suffix:$port/$name.crt
crl_url = http://$host.$domain_suffix:$port/$name.crl
default_ca = ca_default
name_opt = utf8,esc_ctrl,multiline,lname,align

[ca_dn]
countryName = "US"
organizationName = "Example"
commonName = "Example EBS JAR Private Root CA R1"

[ca_default]
home = .
database = $home/db/index
serial = $home/db/serial
crlnumber = $home/db/crlnumber
certificate = $home/$name.crt
private_key = $home/private/$name.key
RANDFILE = $home/private/random
new_certs_dir = $home/certs
unique_subject = no
copy_extensions = none
default_days = 3653
default_crl_days = 3653
default_md = sha256
policy = policy_c_o_match

[policy_c_o_match]
countryName = supplied
stateOrProvinceName = optional
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

[req]
default_bits = 4096
encrypt_key = yes
default_md = sha256
utf8 = yes
string_mask = utf8only
prompt = no
distinguished_name = ca_dn
req_extensions = ca_ext

[ca_ext]
basicConstraints = critical,CA:true,pathlen:0
keyUsage = critical,keyCertSign,cRLSign
subjectKeyIdentifier = hash

[crl_info]
URI.0 = $crl_url

[issuer_info]
caIssuers;URI.0 = $aia_url
EOF

Generate private key

openssl req -new \
-config ebsca.conf \
-out ebsca.csr \
-keyout private/ebsca.key

Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

The generated (ebsca.key) is the private key and must be kept in secure place.

Self-sign the root CA certificate

openssl ca -selfsign \
-config ebsca.conf \
-in ebsca.csr \
-out ebsca.crt \
-extensions ca_ext
Enter pass phrase for ./private/ebsca.key:

The generated ebsca.crt is the root CA certificate which the Forms clients must trust.

openssl’s ca command keeps track of issued certificates in the text file db/index

# cat db/index | tr '\t' ' '
V 340105050154Z 66F314E24AC4FDB09BD9912E7108EA8D unknown /C=US/O=Example/CN=Example EBS JAR Private Root CA R2

so far this CA has only signed its own certificate.

Generate (empty) CRL

openssl ca -gencrl \
-config ebsca.conf \
-out ebsca.crl

The generated ebsca.crl is used by clients to check the revocation status of a certificate, without this file there were will be an error launching forms, this file will also be used for EACH EBS instance that shares the code signing certificate, if you are going to host this file on EBS it is best to put on your PRODUCTION node

Create Configuration File for Leaf Certificates (Code Signing)

cat ebsca.conf | sed 's/^copy_extensions.*$/copy_extensions = copy/' > leaf.conf
cat >> leaf.conf <<EOF
[code_ext]
authorityInfoAccess = @issuer_info
authorityKeyIdentifier = keyid:always
basicConstraints = critical,CA:false
crlDistributionPoints = @crl_info
extendedKeyUsage = codeSigning
keyUsage = critical,digitalSignature
subjectKeyIdentifier = hash
EO

Now Private CA is ready to sign the EBS jar files

How to sign the EBS jar files

As the operator of the private CA, you will receive a Certificate Signing Request in the form of a *.csr (adkeystore.csr) file. Sign to produce a signed code signing certificate using the following command

$ openssl ca -config leaf.conf -extensions code_ext -in adkeystore.csr -out adkeystore.crt

The newly generated adkeystore.crt and existing root (ebsca.crt) will have to be returned to the requestor for import into EBS JAR signing keystore file (adkeystore.dat)

How to Revoke a Certificate

In the unlikely situation that you need to revoke a certificate (invalidate a not yet expired leaf certificate) the following command is used.

$ openssl ca -config ebsca.conf \
-revoke certs/.pem \
-crl_reason keyCompromise

(The -crl_reason can be one of the following unspecified, keyCompromise, CACompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, and removeFromCRL)

Related Articles

Jar Signing in Oracle EBS
EBS Jar signing with HSM Based Certificate