I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of signing certificates, or 20 page papers on the algorithms used. However, I am really trying to understand the way certificates are added on from the basic public and private key.
I would really like to understand how this works, on a level in between the mathematics and the general "it's used for validation" explanations - ideally - precisely defined inputs and outputs but I don't care how the algorithm works to produce the output. Here is what I understand:
- I create a root private key (random base 64 number) (rootkey.key)
- I create a root public certificate with that rootkey (rootcert.crt), this contains the inverse of the rootkey, i.e. public key (q1)
- I create a server private key (random base 64 number) (serverkey.key)
- I sign the server private key with the rootkey to create (servercert.crt). (q2)
Now when I establish TLS connection with the server
- I send my tls request with version number.
- Server sends servercert.crt
- I check servercert.crt against rootcert.crt (which I have on client side) (q3)
- If it's trusted then we can continue with exchanging symmetric encryption keys
(q1) A certificate is a string of pseudorandom digits. What is the mapping between the public key + some strings of domain name, email etc. and these digits? My first thought is this is encrypted with the private key, but then, how could you decrypt since the public key is inside?
(q2) what is happening here? Is this the same process, using rootkey, as step 2?
(q3) What am I doing here? decrypting the server.crt with the public key from the rootcert.crt makes sense as server.crt would be encrypted with the rootkey, but how do I get that root public key?
I think fundamentally it boils down to what is the structure of the certificate. Not just what it contains written in ASN.1 as I read on wikipedia, but mapping this to the pseudorandom digits in the file itself. While writing this I narrowed my question a lot, very useful process, but I still cannot figure this out exactly.