There are several ways to operate on certificates. The widest spread method is by openssl library and associated command line tools. Library was not and probably is still not free of bugs. But it’s widely spread  among many operating systems which makes it a tool that easily can be used on most popular operating systems. If you are running Windows Server you can install Certificate Services component, Mac users can use Keychain Access which is core component of macOS.

While working with certificates and those tool remember about best practices. Points below are valid as of the end of 2016.

• Use at least 2048-Bit Private Keys
• Try to avoid wildcard certificates but remember to cover all FQDN’s in certificates
• Use strong certificate signature algorithms – SHA256 is standard now,  SHA-1 has been deprecated
• Use strong encryption for your connection – not really certificate related but worh notifying that TLSv1.2 is now a standard supporting strong cryptographic algorithms
• Use complete certificate chains
• Use strong key exchange and forward secrecy

If you want to know more about best practices you may refer to this short manual.

Read More →