Install EasyRSA (Certificate Authority)-CA on CentOS / RHEL 8

Introduction

Easy-RSA Overview

Easy-RSA is a utility for managing a PKI CA (Certificate Authority) in addition to X.509 PKI, or Public Key Infrastructure. A PKI is based on the notion of trusting a particular authority to authenticate a remote peer; for more background on how PKI works, see the Intro-To-PKI document.

The code written in platform-neutral POSIX shell, allowing use on a wide range of host systems.The official Windows release also comes bundled with the programs necessary to use Easy-RSA. The shell code attempts to limit the number of external programs it depends on. Crypto-related tasks use openssl as the functional backend.

Feature Highlights

Here’s a non-exhaustive list of the more notable Easy-RSA features:

• Easy-RSA is able to manage multiple PKIs, each with their own independent configuration, storage directory, and X.509 extension handling.
• Multiple Subject Name (X.509 DN field) formatting options supported. For VPNs, this means a cleaner commonName only setup can be used.
• A single backend is used across all supported platforms, ensuring that no platform is ‘left out’ of the rich features. Unix-alikes (BSD, Linux, etc) and Windows are all supported.
• Easy-RSA’s X.509 support includes CRL, CDP, keyUsage/eKu attributes, and additional features. The included support can_be changed or extended as an advanced feature.
• Interactive and automated (batch) modes of operation
• Flexible configuration: features canbe enabled through command-line options, environment variables, a config file, or a combination of these.
• Built-in defaults allow Easy-RSA to be used without first editing a config file.

So EasyRSA is a free and open source CLI utility to create a root certificate authority, and request and sign certificates, including intermediate CAs and certificate revocation lists (CRL).

Update Packages in CentOS / RHEL

Update software packages in your Linux distro, before installing any new software on it.

Therefore, execute dnf command to update software packages in your CentOS / Red Hat Enterprise Linux.

# dnf update -y

Verify the Kernel version used in this installation guide.

[root@rhel-pc ~]# uname -r
4.18.0-305.12.1.el8_4.x86_64
[root@rhel-pc ~]# 

Also Verify the Linux distro version .

[root@rhel-pc ~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.4 (Ootpa)
[root@rhel-pc ~]# 

Install EasyRSA on CentOS / RHEL

Download the latest version of EasyRSA with wget command.

[root@rhel-pc mnt]# cd /mnt
[root@rhel-pc mnt]#  wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.8/EasyRSA-3.0.8.tgz
--2021-08-15 23:10:26--  https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.8/EasyRSA-3.0.8.tgz
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://github-releases.githubusercontent.com/4519663/2e0dee80-f7f3-11ea-9ba4-dc973db12175?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210815%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210815T210829Z&X-Amz-Expires=300&X-Amz-Signature=5199380d851889a82d52ae4950917b20c7717e387f0c6b62054969f554de8e04&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=4519663&response-content-disposition=attachment%3B%20filename%3DEasyRSA-3.0.8.tgz&response-content-type=application%2Foctet-stream [following]
--2021-08-15 23:10:28--  https://github-releases.githubusercontent.com/4519663/2e0dee80-f7f3-11ea-9ba4-dc973db12175?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210815%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210815T210829Z&X-Amz-Expires=300&X-Amz-Signature=5199380d851889a82d52ae4950917b20c7717e387f0c6b62054969f554de8e04&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=4519663&response-content-disposition=attachment%3B%20filename%3DEasyRSA-3.0.8.tgz&response-content-type=application%2Foctet-stream
Resolving github-releases.githubusercontent.com (github-releases.githubusercontent.com)... 185.199.111.154, 185.199.108.154, 185.199.109.154, ...
Connecting to github-releases.githubusercontent.com (github-releases.githubusercontent.com)|185.199.111.154|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 48907 (48K) [application/octet-stream]
Saving to: ‘EasyRSA-3.0.8.tgz’

EasyRSA-3.0.8.tgz                     100%[=======================================================================>]  47.76K  --.-KB/s    in 0.1s    

2021-08-15 23:10:29 (414 KB/s) - ‘EasyRSA-3.0.8.tgz’ saved [48907/48907]

[root@rhel-pc mnt]# 

Extract downloaded tar file by executing tar command.

[root@rhel-pc mnt]# tar xfv EasyRSA-3.0.8.tgz 
EasyRSA-3.0.8/
EasyRSA-3.0.8/easyrsa
EasyRSA-3.0.8/openssl-easyrsa.cnf
EasyRSA-3.0.8/vars.example
EasyRSA-3.0.8/x509-types/
EasyRSA-3.0.8/gpl-2.0.txt
EasyRSA-3.0.8/mktemp.txt
EasyRSA-3.0.8/COPYING.md
EasyRSA-3.0.8/ChangeLog
EasyRSA-3.0.8/README.md
EasyRSA-3.0.8/README.quickstart.md
EasyRSA-3.0.8/doc/
EasyRSA-3.0.8/doc/EasyRSA-Advanced.md
EasyRSA-3.0.8/doc/EasyRSA-Readme.md
EasyRSA-3.0.8/doc/EasyRSA-Upgrade-Notes.md
EasyRSA-3.0.8/doc/Hacking.md
EasyRSA-3.0.8/doc/Intro-To-PKI.md
EasyRSA-3.0.8/x509-types/COMMON
EasyRSA-3.0.8/x509-types/ca
EasyRSA-3.0.8/x509-types/client
EasyRSA-3.0.8/x509-types/code-signing
EasyRSA-3.0.8/x509-types/email
EasyRSA-3.0.8/x509-types/kdc
EasyRSA-3.0.8/x509-types/server
EasyRSA-3.0.8/x509-types/serverClient
[root@rhel-pc mnt]# 

Then rename the extracted directory.

[root@rhel-pc mnt]# mv EasyRSA-3.0.8 EasyRSA

Generate PKI and CA Certificate

you can do this with this command below:

[root@rhel-pc mnt]# cd EasyRSA/
[root@rhel-pc EasyRSA]# ./easyrsa init-pki

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /mnt/EasyRSA/pki


[root@rhel-pc EasyRSA]# 

So Now Generate your Certificate Authority (CA) , which will_be used to sign server and client Certificate Signing Requests (CSR) with command below.

[root@rhel-pc EasyRSA]# ./easyrsa build-ca
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020

Enter New CA Key Passphrase: 
Re-Enter New CA Key Passphrase: 
Generating RSA private key, 2048 bit long modulus (2 primes)
..................+++++
...........................................................................................................................................................+++++
e is 65537 (0x010001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:unixcop

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/mnt/EasyRSA/pki/ca.crt


[root@rhel-pc EasyRSA]# 

Generate Server SSL Certificate

So we will generate a RSA Private Key and CSR with command below.

[root@rhel-pc EasyRSA]# ./easyrsa gen-req easyrsa.unixcop.com nopass
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020
Generating a RSA private key
............................................................................................................................................................................................+++++
..........+++++
writing new private key to '/mnt/EasyRSA/pki/easy-rsa-6230.db5Ie8/tmp.5R7sqs'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [easyrsa.unixcop.com]:

Keypair and certificate request completed. Your files are:
req: /mnt/EasyRSA/pki/reqs/easyrsa.unixcop.com.req
key: /mnt/EasyRSA/pki/private/easyrsa.unixcop.com.key


[root@rhel-pc EasyRSA]# 

In addition to, Sign your server CSR by using Certificate Authority (CA) private key.

[root@rhel-pc EasyRSA]# ./easyrsa sign-req server easyrsa.unixcop.com
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020


You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 825 days:

subject=
    commonName                = easyrsa.unixcop.com


Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes
Using configuration from /mnt/EasyRSA/pki/easy-rsa-6260.UVEjyC/tmp.nTGkfr
Enter pass phrase for /mnt/EasyRSA/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'easyrsa.unixcop.com'
Certificate is to be certified until Nov 18 21:18:53 2023 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /mnt/EasyRSA/pki/issued/easyrsa.unixcop.com.crt


[root@rhel-pc EasyRSA]# 

You have successfully signed the SSL certificate.

Also To verify is your SSL Certificate is correctly generated, you can execute openssl command as shown below.

[root@rhel-pc EasyRSA]#  openssl verify -CAfile pki/ca.crt /mnt/EasyRSA/pki/issued/easyrsa.unixcop.com.crt
/mnt/EasyRSA/pki/issued/easyrsa.unixcop.com.crt: OK
[root@rhel-pc EasyRSA]# 

Generate (Diffie Hellman) Key

So We will generate a Diffie Hellman key to be used by the key exchange process.Use below command to generate it.

[root@rhel-pc EasyRSA]# ./easyrsa gen-dh
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
......................................................................................................................................................................................................................................................................................................................................+..+...........................................+.....................+..........................................................................................+..........................................................................................................................................................................................................................................................................................................................................................................+........................................+....................................................................................................................+............................................................................................................................................................................................................+...................................+........................................................................................................................................................................................................................................................................+...........+......................................................................................................+...........................................................+..........................+...............................................................................................................................................+..................................................++*++*++*++*

DH parameters of size 2048 created at /mnt/EasyRSA/pki/dh.pem


[root@rhel-pc EasyRSA]# 

Generate a Client SSL Certificate

Generate a SSL certificate for your client.

as shown in the example the client will be qadry.unixcop.com

[root@rhel-pc EasyRSA]#  ./easyrsa gen-req qadry.unixcop.com nopass
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020
Generating a RSA private key
..+++++
.............................+++++
writing new private key to '/mnt/EasyRSA/pki/easy-rsa-6458.r26VDM/tmp.fjd968'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [qadry.unixcop.com]:

Keypair and certificate request completed. Your files are:
req: /mnt/EasyRSA/pki/reqs/qadry.unixcop.com.req
key: /mnt/EasyRSA/pki/private/qadry.unixcop.com.key


[root@rhel-pc EasyRSA]# 

Also you can Sign the client SSL certificate as Shown below.

[root@rhel-pc EasyRSA]# ./easyrsa sign-req client qadry.unixcop.com
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020


You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a client certificate for 825 days:

subject=
    commonName                = qadry.unixcop.com


Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes
Using configuration from /mnt/EasyRSA/pki/easy-rsa-6507.0eJrdy/tmp.sFYefJ
Enter pass phrase for /mnt/EasyRSA/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'qadry.unixcop.com'
Certificate is to be certified until Nov 18 21:29:23 2023 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /mnt/EasyRSA/pki/issued/qadry.unixcop.com.crt


[root@rhel-pc EasyRSA]# 

So You have successfully generated and signed the client SSL certificate.

Also Copy your Certificate Authority (CA) certificate in /etc/pki/ca-trust/source/anchors/ of your Linux clients to add your CA to their trusted CA list.

Conclusion

So We have successfully installed EasyRSA on CentOS / Red Hat Enterprise Linux 8. We have also configured a Certificate Authority and Signed SSL certificates of server and client by using easyrsa command.