Vulnarex | Elite Cybersecurity Learning Platform

#Building Your Own Trust Anchor#link

Theory is useless without practice. In this lab, you will act as a Certificate Authority (CA). You will create a Root CA, an Intermediate CA, and a Leaf certificate, simulating a real-world PKI hierarchy.

Phase 1: Creating the Root CA

The Root CA is the ultimate source of trust. It must be created with a long lifespan and kept secure.

Generate Root Private Key and Self-Signed Certificate

root@vulnarex:~#openssl genrsa -out rootCA.key 4096 openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.crt

info

💡 In production, the rootCA.key would be stored in an offline HSM, not on your hard drive.

Phase 2: The Intermediate CA

To protect the root, we create an Intermediate CA. The root signs the intermediate, and the intermediate signs the actual servers.

bash

# 1. Generate Intermediate Key
openssl genrsa -out intermediate.key 4096
# 2. Generate CSR (Certificate Signing Request)
openssl req -new -key intermediate.key -out intermediate.csr
# 3. Root CA signs the Intermediate CSR
openssl x509 -req -in intermediate.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out intermediate.crt -days 1095 -sha256

The intermediate certificate is now trusted because it was signed by the Root CA. This is the 'Chain of Trust' in action.

Phase 3: Issuing a Leaf Certificate

Generate and Sign a Server Certificate

root@vulnarex:~#openssl genrsa -out server.key 2048 openssl req -new -key server.key -out server.csr openssl x509 -req -in server.csr -CA intermediate.crt -CAkey intermediate.key -CAcreateserial -out server.crt -days 90 -sha256

File	Role	Sensitivity
rootCA.key	Root Secret	Critical (Ultra-Secret)
intermediate.crt	Public Trust	Low (Public)
server.key	Server Secret	High (Secret)
server.crt	Server ID	Low (Public)

Verification and Validation

Finally, we must verify that the certificate chain is valid. If any link is missing or expired, the connection will be rejected.

Verify the Chain of Trust

root@vulnarex:~#openssl verify -CAfile rootCA.crt -untrusted intermediate.crt server.crt

▪Check the Common Name (CN) matches the domain
▪Verify the expiration date using -noout -dates
▪Ensure the key size is at least 2048 bits
▪Check the signature algorithm (SHA-256)

STRICT SECURE AUDIT RULE

Never use the Root CA key to sign leaf certificates directly. If a leaf is compromised, you'd have to rotate the root, breaking everything.

quiz BLOCK (★ 50 XP)

Why is the 'Intermediate CA' necessary in a professional PKI setup?

Select your proof vectors above

challenge BLOCK (★ 100 XP)

The Expired Link