$./CA.pl -newca
CA certificate filename (or enter to create)

Making CA certificate ...
Generating a 1024 bit RSA private key
..........++++++
.....................++++++
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank.
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:US
State or Province Name (full name) []:Colorado
Locality Name (eg, city) []:Denver
Organization Name (eg, company) []:NonExistant Enterprises
Organizational Unit Name (eg, section) []:IT Services
Common Name (eg, fully qualified host name) []:ca.nonexistantdomain.com
Email Address []:certadmin@nonexistantdomain.com
-------------------------
$ ls -l demoCA/
total 16
-rw-r--r--  1 andrew  andrew  1399  3 Dec 19:52 cacert.pem
drwxr-xr-x  2 andrew  andrew    68  3 Dec 19:49 certs
drwxr-xr-x  2 andrew  andrew    68  3 Dec 19:49 crl
-rw-r--r--  1 andrew  andrew     0  3 Dec 19:49 index.txt
drwxr-xr-x  2 andrew  andrew    68  3 Dec 19:49 newcerts
drwxr-xr-x  3 andrew  andrew   102  3 Dec 19:49 private
-rw-r--r--  1 andrew  andrew     3  3 Dec 19:49 serial
-------------------------
$DAYS="-days 365";
-------------------------
$ openssl req -new -x509 -keyout cakey.pem -out cakey.pem -days 3650
-------------------------
$ ./CA.pl -newreq-nodes
Generating a 1024 bit RSA private key
...++++++
...............................................++++++
writing new private key to 'newreq.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank.
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Colorado
Locality Name (eg, city) []:Denver
Organization Name (eg, company) [Internet Widgits Pty Ltd]:NonExistant Enterprises
Organizational Unit Name (eg, section) []:IT Services
Common Name (eg, YOUR name) []:mail.nonexistantdomain.com
Email Address []:postmaster@nonexistantdomain.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:NonExistant Enterprises
Request (and private key) is in newreq.pem
-------------------------
$ ./CA.pl -sign
Using configuration from /System/Library/OpenSSL/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Dec  3 09:05:08 2003 GMT
            Not After : Dec  3 09:05:08 2004 GMT
        Subject:
            countryName               = US
            stateOrProvinceName       = Colorado
            localityName              = Denver
            organizationName          = NonExistant Enterprises
            organizationalUnitName    = IT Services
            commonName                = mail.nonexistantdomain.com
            emailAddress              = postmaster@nonexistantdomain.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
            CA:FALSE
            Netscape Comment: 
            OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
            94:0F:E9:F5:22:40:2C:71:D0:A7:5C:65:02:3E:BC:D8:DB:10:BD:88
            X509v3 Authority Key Identifier: 
            keyid:7E:AF:2D:A4:39:37:F5:36:AE:71:2E:09:0E:49:23:70:61:28:5F:4A
            DirName:/C=US/ST=Colorado/L=Denver/O=NonExistant Enterprises/OU=
            IT Services/
CN=Certificate Administration/emailAddress=certadmin@nonexistantdomain.com
            serial:00

Certificate is to be certified until Dec  7 09:05:08 2004 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem

