Skip to main content
Version: 3.6 (unsupported)

How to get a certificate

This document describes how to get a certificate to enroll in ScalarDL network.

Prerequisites​

We basically use CFSSL components for CA server and certificate handling.

Generate a private key and a CSR​

$ openssl ecparam -name prime256v1 -out prime256v1.pem
$ openssl req -new -newkey ec:prime256v1.pem -nodes -keyout client-key.pem.pkcs8 -out client.csr
$ openssl ec -in client-key.pem.pkcs8 -out client-key.pem

or

$ cat << EOF > client-cert.json
{
    "CN": "client.example",
    "key": {
        "algo": "ecdsa",
        "size": 256
    },
    "names": [
        {
            "O": "Client Example",
            "L": "Shinjuku",
            "ST": "Tokyo",
            "C": "JP"
        }
    ]
}
EOF

$ cfssl selfsign "" ./client-cert.json | cfssljson -bare client
$ ls -1
client-cert.json
client-key.pem
client.csr
client.pem

Get a certificate from a CA Server​

cfssl sign -remote "localhost:8888" -profile "client" client.csr | cfssljson -bare client -
  • NOTE: -remote option is needed to specify the CA endpoint URI
  • NOTE: -bare option for cfssljson is needed to specify a prefix of output key files

You will get a certificate named client.pem from CA, and are almost ready to execute your contracts.