# How to generate certificates

self-signed certificate in `assets/_common/ssl` and `assets/_common/ssl` for integration-tests

## Key generation (done)

Generate RSA private key (don't replace pass:x, it will be ignored):

```sh
openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
```

Strip passphrase protection:

```sh
openssl rsa -passin pass:x -in server.pass.key -out server.key rm server.pass.key
```

## Certificate validity verification

```sh
openssl x509 -in server.crt -noout -text
```

check validity fields

beware of CN

## Certificate regeneration

Generate CSR for self-signing:

```sh
openssl req -new -key server.key -out server.csr
```

Create self-signed certificate for 1 year:

```sh
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
```

To extend the certificate validity period, generate another CSR, then use it to generate a new self-signed certificate.
