Software Freedom Kosova Conference

Presenter: Blerim Rexha, Ehat Qerimi, Haxhi Lajqi
Session: 1
Room: MainRoom

In this paper we present a different approach, by using command line scripts for building a governmental Certification Authority (CA) using OpenSSL tool.
OpenSSL is a project driven by volunteer programmers to develop an open source toolkit for implementing the SSL, TLS and general purpose cryptographic libraries. OpenSSL is a command line driven tool, therefore the challenge was creating (changing) the configuration file and writing a script for generating a X.509 certificate. The OpenSSL configuration file, which has the format of a standard INI file, with predefined sections, user defined sections, and values is used to generate private and public keys and also to sign the private based on the data on configuration file. Furthermore we use OpenSSL for signing the Certification Revocation List (CRL).
We will create the Root Certification Authority (Root CA) and Issuer CA. The Issuer CA shall be responsible for issuing ISO X.509 certificates to end users.
We compare, pro’s and con’s of OpenSSL with Microsoft’s certificate Services, which are part of Windows Server since year 2000.