Changing the Subject's property of a self-signed certificate

Question

I have generated a self-signed certificate using this very good tutorial:

https://www.youtube.com/watch?v=1xtBkukWiek

However, when I import the certificate, both the Subject ("issued to") and Issuer ("issued by") properties display in the certificate store as the "Common name" which is provided during the setup process. How can I create an X509 certificate and specify different values for Subject and Issuer?

You can't change anything about a certificate once issued. Otherwise you could forge them, and they did think of that. You have to start again. — user207421, Nov 07 '16 at 11:27
@EJP My question is "How can I create an X509 certificate and specify different values for Subject and Issuer?" — Guru Josh, Nov 07 '16 at 11:59
I am commenting on what it says in your title. If that's not your question, fix it. Your comment embodies a contradiction in terms. *Either* the subject and issuer are the same *or* it isn't self-signed. — user207421, Nov 07 '16 at 16:24

score 1 · Answer 1 · edited May 23 '17 at 11:45

How can I create an X509 certificate and specify different values for "issued to" and "issued by"?

You can't. Self-signed means the Issuer's Distinguished Name is the same as the Subject's Distinguished Name. It also means the Authority Key Identifier (AKI) is the same a s the Subject Public Key (SPKI).

Here's an example from a CA root, which is a self signed certificate, too. There are a few differences between a CA root and a self signed end-entity certificate. For example, a CA sets Basic Constraint's CA=true and critical.

$ openssl x509 -in DigiCertHighAssuranceEVRootCA.pem -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
        Validity
            Not Before: Nov 10 00:00:00 2006 GMT
            Not After : Nov 10 00:00:00 2031 GMT
        Subject: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c6:cc:e5:73:e6:fb:d4:bb:e5:2d:2d:32:a6:df:
                    e5:81:3f:c9:cd:25:49:b6:71:2a:c3:d5:94:34:67:
                    a2:0a:1c:b0:5f:69:a6:40:b1:c4:b7:b2:8f:d0:98:
                    a4:a9:41:59:3a:d3:dc:94:d6:3c:db:74:38:a4:4a:
                    cc:4d:25:82:f7:4a:a5:53:12:38:ee:f3:49:6d:71:
                    91:7e:63:b6:ab:a6:5f:c3:a4:84:f8:4f:62:51:be:
                    f8:c5:ec:db:38:92:e3:06:e5:08:91:0c:c4:28:41:
                    55:fb:cb:5a:89:15:7e:71:e8:35:bf:4d:72:09:3d:
                    be:3a:38:50:5b:77:31:1b:8d:b3:c7:24:45:9a:a7:
                    ac:6d:00:14:5a:04:b7:ba:13:eb:51:0a:98:41:41:
                    22:4e:65:61:87:81:41:50:a6:79:5c:89:de:19:4a:
                    57:d5:2e:e6:5d:1c:53:2c:7e:98:cd:1a:06:16:a4:
                    68:73:d0:34:04:13:5c:a1:71:d3:5a:7c:55:db:5e:
                    64:e1:37:87:30:56:04:e5:11:b4:29:80:12:f1:79:
                    39:88:a2:02:11:7c:27:66:b7:88:b7:78:f2:ca:0a:
                    a8:38:ab:0a:64:c2:bf:66:5d:95:84:c1:a1:25:1e:
                    87:5d:1a:50:0b:20:12:cc:41:bb:6e:0b:51:38:b8:
                    4b:cb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                B1:3E:C3:69:03:F8:BF:47:01:D4:98:26:1A:08:02:EF:63:64:2B:C3
            X509v3 Authority Key Identifier: 
                keyid:B1:3E:C3:69:03:F8:BF:47:01:D4:98:26:1A:08:02:EF:63:64:2B:C3

    Signature Algorithm: sha1WithRSAEncryption
         1c:1a:06:97:dc:d7:9c:9f:3c:88:66:06:08:57:21:db:21:47:
         f8:2a:67:aa:bf:18:32:76:40:10:57:c1:8a:f3:7a:d9:11:65:
         8e:35:fa:9e:fc:45:b5:9e:d9:4c:31:4b:b8:91:e8:43:2c:8e:
         b3:78:ce:db:e3:53:79:71:d6:e5:21:94:01:da:55:87:9a:24:
         64:f6:8a:66:cc:de:9c:37:cd:a8:34:b1:69:9b:23:c8:9e:78:
         22:2b:70:43:e3:55:47:31:61:19:ef:58:c5:85:2f:4e:30:f6:
         a0:31:16:23:c8:e7:e2:65:16:33:cb:bf:1a:1b:a0:3d:f8:ca:
         5e:8b:31:8b:60:08:89:2d:0c:06:5c:52:b7:c4:f9:0a:98:d1:
         15:5f:9f:12:be:7c:36:63:38:bd:44:a4:7f:e4:26:2b:0a:c4:
         97:69:0d:e9:8c:e2:c0:10:57:b8:c8:76:12:91:55:f2:48:69:
         d8:bc:2a:02:5b:0f:44:d4:20:31:db:f4:ba:70:26:5d:90:60:
         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:
         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:
         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:
         77:e8:1f:4a

... I have generated a self-signed certificate using this very good tutorial: https://www.youtube.com/watch?v=1xtBkukWiek.

I did not watch your video, but you may be interested in the following if you are missing attributes like Authority Key Identifier (AKI):

I am quite new to the subject of digital certificates. I may have used incorrect terminology. I want to create a certificate issued from my organisation to another for encryption of SQL Server data traffic on a LAN. So is that called a "CA Root Certificate" rather than a "Self Signed Certificate"? I want to create something similar to certificates that I have been issued with for accessing VPN's. Those certificates are issued to me from the company that is granting me the VPN access. — Guru Josh, Nov 07 '16 at 12:09
@Guru - Maybe you should review [PKIX Terminology](http://www.google.com/search?num=40&q=pkix+terminology) before we go any further. — jww, Nov 07 '16 at 14:51
OK so I have managed to create and import a p12 certificate. It appears to have imported 2 certificates - a root CA certificate (issued to the fully qualified domain name of the machine running SQL Server) and a self-signed certificate. However, after selecting the certificate in SQL Server Configuration Manager protocols, the associated SQL Server service does not restart. It is failing with error "SQL Server could not spawn FRunCommunicationsManager thread." — Guru Josh, Nov 08 '16 at 01:20
@Guru _ OK, thanks. That's a markedly different question/problem. Now would be a good time to ask a new question. There's lots of *"Convert PKCS#12 Cert+Key into Keystore"* and *"Export PKCS#12 Cert+Key"* type questions already answered. Review a few of them, and then ask a new question. — jww, Nov 08 '16 at 01:33

Changing the Subject's property of a self-signed certificate

1 Answers1