How can I create TLS certificates with OpenSSL? (Server only / CA-signed / mTLS)

You can prepare TLS certificates for ObjectDeliverer using OpenSSL.
This page shows minimal steps for three common patterns.

Prerequisites:

  • OpenSSL available on your environment (macOS / Linux / WSL, etc.)
  • SAN (subjectAltName) must match the hostname/IP you pass to InitializeTls(...)

1. Server certificate only (self-signed)

Use this for development with self-signed cert + public key pinning.

mkdir -p tls/pattern1 && cd tls/pattern1

# 1) Server private key
openssl genrsa -out server.key 2048

# 2) Certificate config (SAN: localhost / 127.0.0.1)
cat > server.cnf <<'EOF'
[req]
distinguished_name = dn
x509_extensions = v3_req
prompt = no
[dn]
C = JP
O = ObjectDeliverer
CN = localhost
[v3_req]
subjectAltName = @alt_names
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
[alt_names]
DNS.1 = localhost
IP.1 = 127.0.0.1
EOF

# 3) Self-signed server certificate
openssl req -x509 -new -key server.key -sha256 -days 365 \
  -out server.crt -config server.cnf

# 4) Public key hash (for WithPinnedPublicKeyFromFile)
openssl x509 -in server.crt -pubkey -noout \
  | openssl pkey -pubin -outform DER \
  | openssl dgst -sha256 -binary \
  | xxd -p -c 32 \
  | sed 's/../&:/g; s/:$//' > server.pubkey.txt

ObjectDeliverer setup:

  • Server: server.crt + server.key
  • Client:
    • WithCertificateVerification()
    • WithAllowSelfSignedCertificates(true)
    • WithPinnedPublicKeyFromFile(".../server.pubkey.txt")

2. CA certificate + server certificate (CA-signed)

Common setup for production/private networks.

mkdir -p tls/pattern2 && cd tls/pattern2

# 1) CA (self-signed root)
openssl genrsa -out ca.key 4096
openssl req -x509 -new -key ca.key -sha256 -days 3650 \
  -out ca.crt -subj "/C=JP/O=ObjectDeliverer/CN=ObjectDeliverer Test CA"

# 2) Server key + CSR
openssl genrsa -out server.key 2048
cat > server.cnf <<'EOF'
[req]
distinguished_name = dn
prompt = no
[dn]
C = JP
O = ObjectDeliverer
CN = localhost
EOF
openssl req -new -key server.key -out server.csr -config server.cnf

# 3) Sign with CA (with SAN and EKU)
cat > server.ext <<'EOF'
basicConstraints=CA:FALSE
keyUsage=critical,digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth
subjectAltName=@alt_names
[alt_names]
DNS.1=localhost
IP.1=127.0.0.1
EOF
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out server.crt -days 825 -sha256 -extfile server.ext

ObjectDeliverer setup:

  • Server: server.crt + server.key
  • Client:
    • WithCertificateVerification()
    • WithTrustedCaCertificate(".../ca.crt")

3. CA + server certificate + mTLS client certificate

Use this for mutual TLS where the server also authenticates clients.

mkdir -p tls/pattern3 && cd tls/pattern3

# 1) CA
openssl genrsa -out ca.key 4096
openssl req -x509 -new -key ca.key -sha256 -days 3650 \
  -out ca.crt -subj "/C=JP/O=ObjectDeliverer/CN=ObjectDeliverer Test CA"

# 2) Server certificate (serverAuth)
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr \
  -subj "/C=JP/O=ObjectDeliverer/CN=localhost"
cat > server.ext <<'EOF'
basicConstraints=CA:FALSE
keyUsage=critical,digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth
subjectAltName=@alt_names
[alt_names]
DNS.1=localhost
IP.1=127.0.0.1
EOF
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out server.crt -days 825 -sha256 -extfile server.ext

# 3) Client certificate (clientAuth)
openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr \
  -subj "/C=JP/O=ObjectDeliverer/CN=od-client-01"
cat > client.ext <<'EOF'
basicConstraints=CA:FALSE
keyUsage=critical,digitalSignature,keyEncipherment
extendedKeyUsage=clientAuth
EOF
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out client.crt -days 825 -sha256 -extfile client.ext

ObjectDeliverer setup:

  • Server:
    • CreateProtocolTcpIpServerTls(..., server.crt, server.key, ...)
    • WithClientAuthMode(Required) (or Optional)
    • WithClientCaBundle(".../ca.crt")
  • Client:
    • WithCertificateVerification()
    • WithTrustedCaCertificate(".../ca.crt")
    • WithClientCertificate(".../client.crt", ".../client.key")

Minimal validation commands

# Check SAN / EKU in server cert
openssl x509 -in server.crt -noout -text | grep -E "Subject:|DNS:|IP Address|Extended Key Usage"

# Verify CA chain (pattern 2/3)
openssl verify -CAfile ca.crt server.crt
openssl verify -CAfile ca.crt client.crt

Notes:

  • Do not run pattern 1 (self-signed) without pinning.
  • In production, define key storage, permissions, and rotation procedures.
Back to FAQ