I'm configuring a series of MariaDB servers with SSL protection. I was able to do it creating different self-signed certificates, as everybody can do just following some of the multiple tutorials you can find around the Internet.

However I was wondering if it's possible to use our wildcard certificate (the one that we use for our https servers) to generate the same files.

The self-signed procedure runs at follows

  1. Generate root CA
  2. Generate the server key
  3. Generate the x509 cert signed with the CA key
  4. Generate the client key
  5. Generate the x509 cert signed with the CA key

From my Cert provider I got:

  1. certificate.crt
  2. certificate.key
  3. certificate.ca.crt

Obviously, I'm missing the CA key

Can I use this files to generate the server and client certs?

-- Add here the openssl command I use to generate the self signed certs

#Generate certificates
#Generate root-CA
openssl genrsa 2048 > ca-key.pem
openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca-cert.pem -subj "/C=XX/ST=XXXXXX/CN=BI-XXXXXX"

# server key
openssl req -newkey rsa:2048 -days 3600 -nodes -keyout server-key.pem -out server-req.pem -subj "/C=XX/ST=XXXXXXX/CN=BI-XXXXXXX-Server"
openssl rsa -in server-key.pem -out server-key.pem
openssl x509 -req -in server-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

# client key
openssl req -newkey rsa:2048 -days 3600 -nodes -keyout client-key.pem -out client-req.pem -subj "/C=XX/ST=XXXXXXXX/CN=BI-XXXXXXXX-Client"
openssl rsa -in client-key.pem -out client-key.pem
openssl x509 -req -in client-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem```
  • Not sure what you're asking. How to sign a server certificate without the CA key? You can't, obviously.
    – mustaccio
    May 19, 2022 at 19:52
  • @mustaccio Hi, what I want to achieve (if possible) is generate my server and client certificates, but not from a selfsigned root-CA. I want to use my wildcard certificates so certificates are "trustable" May 20, 2022 at 8:58


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.