MAKE-CA(8)

NAME
make-ca - manual page for make-ca 0.7

DESCRIPTION
make-ca is a utility to deliver and manage a complete PKI configuration for workstaitons and servers using only standard Unix utilities and OpenSSL. It will optionally generate keystores for OpenJDK and NSS if already installed, using a Mozilla cacerts.txt or like formatted file. It was originally developed for use with Linux From Scratch to minimize dependencies for early system build, but has been written to be generic enough for any Linux distribution.

-C, --certdata [certdata.txt]
    The location of the certificates source.

-D, --destdir [/]
    Change the output directory and use relative paths for all other values.

-P, --pkidir [/etc/pki]
    The output PKI directory - Cannot be used with the -a / --anchordir or -n / --nssdb switches

-S, --ssldir [/etc/ssl]
    The output SSL root direcotry - Cannot be used with the -c / --cafile, -d / --cadir, or -j / --javacerts switches

-a, --anchordir [$PKIDIR/anchors]
    The output directory for OpenSSL trusted CA certificates used as trust anchors.

-c, --cafile [$SSLDIR/ca-bundle.crt]
    The output filename for the PEM formated bundle

-d, --cadir [$SSLDIR/certs]
    The output directory for the OpenSSL trusted CA certificates

-j, --javacerts [$SSLDIR/java
    The output directory for the Java cacerts.{jks,p12} files

-l, --localdir [$SSLDIR/local]
    The path to a local set of OpenSSL trusted certificates, used to both override trust bits from upstream sources and provide locally provided certifiates.

-n, --nssdb [$PKIDIR/nssdb]
    The output path for the shared NSS DB

-p, --proxy [URI:PORT]
    Use proxy server for download

-k, --keytool [PATH]
    The path to the java keytool utility

-s, --openssl [PATH]
    The path to the openssl utility

-t, --certutil [PATH]
    The path the certutil utility

-f, --force
    Force run, even if source is not newer

-g, --get
    Download certdata.txt directly from Mozilla's Mecurial server.

-h, --help
    Show this help message and exit

-r, --rebuild
    Rebuild the enitre PKI tree using the previous certdata.txt file.

-v. --version
    Show version information and exit

Example: make-ca -f -C ~/certdata.txt

SYNOPSYS
make-ca -g

EXAMPLES
The make-ca script will process the certificates included in the certdata.txt file for use in multiple certificate stores (if the associated applications are present on the system). Additionally, any local certificates stored in /etc/ssl/local will be imported to the certificate stores. Certificates in this directory should be stored as PEM encoded OpenSSL trusted certificates. To create an OpenSSL trusted certificate from a regular PEM encoded file, provided by a CA not included in Mozilla's certificate distribution, you need to add trust arguments to the openssl command, and create a new certificate. There are three trust types that are recognized by the make-ca.sh script, SSL/TLS, S/Mime, and code signing. For example, using the CAcert root, if you want it to be trusted for all three roles, the following commands will create an appropriate OpenSSL trusted certificate:
  # install -vdm755 /etc/ssl/local
  # wget http://www.cacert.org/certs/root.crt
  # openssl x509 -in root.crt -text -fingerprint \
                 -setalias "CAcert Class 1 root" \
                 -addtrust serverAuth \
                 -addtrust emailProtection \
                 -addtrust codeSigning \
            > /etc/ssl/local/CAcert_Class_1_root.pem If one of the three trust arguments is omitted, the certificate is neither trusted, nor rejected for that role. Clients that use OpenSSL or NSS encountering this certificate will present a warning to the user. Clients using GnuTLS without p11-kit support are not aware of trusted certificates. To include this CA into the ca-bundle.crt (used for GnuTLS), it must have serverAuth trust. Additionally, to explicitly disallow a certificate for a particular use, replace the -addtrust flag with the -addreject flag. Local trust overrides are handled entirely using the /etc/ssl/local directory. To override Mozilla's trust values, simply make a copy of the certificate in the local directory with alternate trust values.