Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, covering certificate extensions, CRL distribution points, OCSP responder configuration, and certificate policy management. Use when standing up an internal CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for TLS, code-signing, or client-authentication use cases.
Start a fresh conversation. Replace the highlighted placeholders.
Use configuring-certificate-authority-with-openssl to design a two-tier internal PKI for [TLS, code-signing, or client authentication] in [test or lab environment], including CA hierarchy, revocation, and policy controls; require authorization before any execution.
Required inputs
[TLS, code-signing, or client authentication]
[test or lab environment]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: configuring-certificate-authority-with-openssldescription: Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, covering certificate extensions, CRL distribution points, OCSP responder configuration, and certificate policy management. Use when standing up an internal CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for TLS, code-signing, or client-authentication use cases.domain: cybersecuritysubdomain: cryptographytags: - cryptography- pki- certificate-authority- openssl- x509version: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.DS-01- PR.DS-02- PR.DS-10mitre_attack: - T1649- T1553.004- T1557- T1587.003
Configuring Certificate Authority with OpenSSL
Overview
A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.
When to Use
When deploying or configuring configuring certificate authority with openssl capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Objectives
Create a Root CA with self-signed certificate
Create an Intermediate CA signed by the Root CA
Issue server and client certificates from the Intermediate CA
Configure Certificate Revocation Lists (CRLs)
Implement certificate policies and constraints
Build a complete PKI hierarchy programmatically
Key Concepts
CA Hierarchy
Root CA (offline, air-gapped)
|
+-- Intermediate CA (online, operational)
|
+-- Server Certificates
+-- Client Certificates
+-- Code Signing Certificates
Certificate Extensions
Extension
Purpose
Critical
basicConstraints
CA:TRUE/FALSE, pathLenConstraint
Yes
keyUsage
keyCertSign, cRLSign, digitalSignature
Yes
extendedKeyUsage
serverAuth, clientAuth, codeSigning
No
subjectKeyIdentifier
Hash of public key
No
authorityKeyIdentifier
Issuer's key identifier
No
crlDistributionPoints
URL to CRL
No
authorityInfoAccess
OCSP responder URL
No
Security Considerations
Root CA private key must be stored offline (air-gapped HSM)
Use minimum 4096-bit RSA or P-384 ECDSA for CA keys