# Configuring Certificate Authority With Openssl

> Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptograph…

- Skill: `wufufu770/configuring-certificate-authority-with-openssl` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/configuring-certificate-authority-with-openssl`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/configuring-certificate-authority-with-openssl/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/configuring-certificate-authority-with-openssl

---


## TL;DR

- **目的**：Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptograph…
- **适用**：AD/网络/红队场景（项目全量测试）
- **输入**：AD CS 服务器 + 证书模板
- **输出**：渗透证据链 + 复现步骤
- **红线**：**仅 A 模式项目全量测试**，B 模式禁用；禁止未授权使用
- **关联**：上游：003-src-session-start → 下游：097-exploiting-active-directory-with-bloodhound, 079-enumerating-cloud-with-cloudfox, 098-exploiting-adcs-with-certipy

# Configuring Certificate Authority with OpenSSL

## Overview

A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.


## When to Use

- When deploying or configuring configuring certificate authority with openssl capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation

## Prerequisites

- Familiarity with cryptography concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities

## Objectives

- Create a Root CA with self-signed certificate
- Create an Intermediate CA signed by the Root CA
- Issue server and client certificates from the Intermediate CA
- Configure Certificate Revocation Lists (CRLs)
- Implement certificate policies and constraints
- Build a complete PKI hierarchy programmatically

## Key Concepts

### CA Hierarchy

```
Root CA (offline, air-gapped)
  |
  +-- Intermediate CA (online, operational)
        |
        +-- Server Certificates
        +-- Client Certificates
        +-- Code Signing Certificates
```

### Certificate Extensions

| Extension | Purpose | Critical |
|-----------|---------|----------|
| basicConstraints | CA:TRUE/FALSE, pathLenConstraint | Yes |
| keyUsage | keyCertSign, cRLSign, digitalSignature | Yes |
| extendedKeyUsage | serverAuth, clientAuth, codeSigning | No |
| subjectKeyIdentifier | Hash of public key | No |
| authorityKeyIdentifier | Issuer's key identifier | No |
| crlDistributionPoints | URL to CRL | No |
| authorityInfoAccess | OCSP responder URL | No |

## Security Considerations

- Root CA private key must be stored offline (air-gapped HSM)
- Use minimum 4096-bit RSA or P-384 ECDSA for CA keys
- Set path length constraints on intermediate CAs
- Implement certificate policies (OIDs)
- Enable CRL and OCSP for revocation checking
- Audit all certificate issuance operations

## Validation Criteria

- [ ] Root CA self-signed certificate is valid
- [ ] Intermediate CA certificate chains to Root CA
- [ ] Issued certificates chain to Intermediate -> Root
- [ ] Path length constraints are enforced
- [ ] CRL is generated and accessible
- [ ] Revoked certificates appear in CRL
- [ ] Certificate policies are correctly embedded

## Output Format

```json
{
  "attack_path": "<chain summary>",
  "steps": [
    {"step": 1, "action": "<technique>", "tool": "<tool>", "result": "<outcome>"},
    ...
  ],
  "evidence": "<log/screenshot path>",
  "impact": "<DA/Admin/DC compromise / credential dump / etc>",
  "cleanup": "<artifact removal checklist>"
}
```

Save to `share/intel/findings/<target>-<ad-<timestamp>.md`.

## Tools & Systems

- **BloodHound** — AD attack path graph
- **Impacket** — Python AD exploitation toolkit
- **CrackMapExec** — AD/SMB enumeration & exploitation
- **Certipy** — AD CS exploitation
- **NetExec** — Modern CrackMapExec fork
- **evilginx2** — AiTM credential harvesting
- **Mimikatz** — Windows credential extraction

All tools require prior `002-src-session-start` confirmation for A mode. B mode禁用所有攻击工具。

## Workflow

1. **Recon** — BloodHound collection via SharpHound or bloodhound-python
2. **Path analysis** — Identify shortest path to DA via BloodHound UI
3. **Initial access** — Phishing (evilginx) or valid creds (compromised)
4. **Lateral movement** — CrackMapExec / Impacket / NetExec across hosts
5. **Privilege escalation** — ADCS, Kerberoast, Shadow Credentials, etc.
6. **DA/DC compromise** — DCSync or mimikatz sekurlsa::logonpasswords
7. **Cleanup** — Remove artifacts, clear logs (if authorized)


## Advanced Techniques

### ACL Abuse Chains
GenericAll + WriteDACL combinations can yield DA in 3 hops. Use BloodHound's "Shortest Paths to Domain Admins" query.

### Cross-Forest Attacks
SID filtering misconfigurations allow cross-forest privilege escalation via trust relationship abuse.