MAKE-CA(8)

NAME
make-ca - manual page for make-ca 1.14

DESCRIPTION
make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers using only standard GNU utilities, OpenSSL, and P11-Kit. It will optionally generate keystores for NSS if already installed, using a Mozilla cacerts.txt or like formatted file. It was originally developed for use with Linux From Scratch to minimize dependencies for early system build, but has been written to be generic enough for any Linux distribution.

-C, --certdata [certdata.txt]
    The location of the certificates source

-D, --destdir [/]
    Change the output directory and use relative paths for all other values

-P, --pkidir [/etc/pki]
    The output PKI root directory - Cannot be used with the -a / --anchordir or -n / --nssdb switches

-S, --ssldir [/etc/ssl]
    The output SSL root direcotry - Cannot be used with the -d / --cadir switch

-a, --anchordir [$PKIDIR/anchors]
    The output directory for .p11-kit trust anchors

-b, --bundledir [$PKIDIR/certs]
    The output direcotry for the PEM formated bundles

-d, --cadir [$SSLDIR/certs]
    The output directory for the OpenSSL trusted CA certificates

-j, --javacerts [$PKIDIR/java/cacerts]
    The output directory for the Java cacerts file(s)

-l, --localdir [$SSLDIR/local]
    The path to a local set of OpenSSL trusted certificates, used to both override trust bits from upstream source and provide system local certifiates

-m, --java-p12
    Export Java PKCS#12 store - this will default to $PKIDIR/java/cacerts.p12 unless modified by the '-j/--javacerts' switch

-n, --nssdb {$PKIDIR/nssdb}
    The output path for the shared NSS DB

-p, --proxy [URI:PORT]
    Use proxy server for download

-k, --keytool [$JAVA_HOME/bin/keytool]
    The path of the Java keytool utility

-s, --openssl [/usr/bin/openssl]
    The path of the openssl utility

-t, --certutil [/usr/bin/certutil]
    The path of the NSS certutil utility

-u, --trust [/usr/bin/trust]
    The path of the p11-kit trust utility

-i, --mscodesign
    Use Microsoft's trust values for code singing You must copy /etc/make-ca/CS.txt to $SSLDIR

-f, --force
    Force run, even if source is not newer

-g, --get
    Download certdata.txt directly from Mozilla's Mecurial server

-h, --help
    Show this help message and exit

-r, --rebuild
    Rebuild the entire PKI tree using the previous certdata.txt file

-v. --version
    Show version information and exit

Example: make-ca -f -C ~/certdata.txt

SYNOPSYS
make-ca -g

EXAMPLES
The make-ca script will process the certificates included in the certdata.txt file, and place them in the system trust anchors, for use in multiple certificate stores. Additionally, any local OpenSSL Trusted certificates stored in /etc/ssl/local will also be imported into the system trust anchors and certificate stores making it a full trust management utiltiy. The make-ca script depends on OpenSSL >= 1.1.0, P11-Kit >= 0.23.19, and optionally NSS >= 3.23 and Java >= 1.7. Additionally, Coreutils, gawk, and sed are used. The default locations for output files can be tailored for your environment via the /etc/make-ca.conf configuration file. A p11-kit helper, copy-trust-modifications, is included for use in p11-kit's trust-extract-compat script (which should be symlinked to the user's path as update-ca-certificates). Manual creation of OpenSSL Trusted certificates is no longer required for general use. Instead, import the certificate using p11-kit's 'trust anchor --store /path/to/certificate.crt' functionality. This will recreate the individual stores assigning approriate permissions to the newly added anchor(s). Additionally, a copy of any newly added anchors will be placed into $LOCALDIR for future use. While the p11-kit trust utility can be used in most simple cases, you may require additional trust arguments for certian certificates. In these cases, you will need to manually create an OpenSSL trusted certificate from a regular PEM encoded file (use -inform for der or pkcs7 encoded certs). There are three trust types that are recognized by the make-ca.sh script, SSL/TLS, S/Mime, and code signing. For example, using the CAcert root, if you want it to be trusted for all three roles, the following commands will create an appropriate OpenSSL Trusted certificate:
  # install -vdm755 /etc/ssl/local
  # wget http://www.cacert.org/certs/root.crt
  # openssl x509 -in root.crt -text -fingerprint \
                 -setalias "CAcert Class 1 root" \
                 -addtrust serverAuth \
                 -addtrust emailProtection \
                 -addtrust codeSigning \
            > /etc/ssl/local/CAcert_Class_1_root.pem If one of the three trust arguments is omitted, the certificate is neither trusted, nor rejected for that role. Clients using GnuTLS without p11-kit support are not aware of trusted certificates. To include this CA into the ca-bundle.crt (used for GnuTLS linked applications not using the p11-module), it must have serverAuth trust. Additionally, to explicitly disallow a certificate for a particular use, replace the -addtrust flag with the -addreject flag. Local trust overrides are handled entirely using the /etc/ssl/local directory. To override Mozilla's trust values, simply make a copy of the certificate in the local directory with alternate trust values.