Creating a certificate

A digital certificate is comparable to an identity card on the internet. It confirms an identity and makes sure documents have not been altered unnoticed. When a PDF is signed, the certificate is used to apply a digital stamp that guarantees the document is genuine and intact.

To create a certificate suitable for signing documents you normally need a certification authority (CA), which checks your identity and signs the certificate. That matters if the certificate is to be trustworthy and accepted by others.

Alternatively you can create self-signed certificates. These are useful in some scenarios but are normally not recommended for use in a production environment, because others do not class them as trustworthy automatically.

To create self-signed certificates you need the OpenSSL program, for instance. A version that runs under Windows is in the Docuflair folder, in the openssl subdirectory.

These general instructions show how to create a self-signed certificate:

1. Generating a private key (KEY)

First generate a private key. That key is used to sign the certificate and should be kept securely. You can use OpenSSL to generate a private key, for example:

openssl genrsa -out private.key 2048

That command creates a private key file named private.key.

2. Creating a certificate signing request (CSR)

With the private key you now create a certificate signing request. That request contains information such as the common name (CN) — normally the domain or the name of the server or the person using the certificate. Run the following command to create a CSR:

openssl req -new -key private.key -out request.csr

or the following command where you use OpenSSL under Windows (you may have to adjust the path to the configuration file):

openssl req -new -key private.key -out request.csr -config openssl.cnf

That command creates a CSR file named request.csr.

3. Signing the certificate yourself

Now use the private key to sign the certificate yourself. Here is an example command:

openssl x509 -req -days 3650 -in request.csr -signkey private.key -out certificate.crt

That command creates a self-signed certificate named certificate.crt.

You have now created a self-signed certificate. Note that self-signed certificates should normally not be used in production environments, because others do not class them as trustworthy automatically. Where you need a certificate that others accept, obtain it from a certification authority (CA) instead.

4. Converting the certificate files to the PKCS12 format

To convert the certificate to the PKCS12 file format you need the files created earlier:

• The “.crt” file: the finished certificate.
• The “.key” file: the private key created with the CSR, which belongs to that certificate.

You can optionally include an intermediate certificate here as well (where one is available). To take the intermediate certificate into the PKCS12 file, open the certificate in an editor. Below the PEM block of the certificate itself, insert the PEM block of the CA certificate. Depending on the certificate provider, the file should now contain two or three PEM text blocks.

The following command uses OpenSSL to bring the certificate (.crt) and the private key (.key) together into one file and saves it as a “p12” file:

openssl pkcs12 -export -in certificate.crt -inkey private.key -out Docuflair.p12

The p12 file produced now contains the private key and the certificate. Its content is protected by a password that is asked for when the certificate is used.