Certificate Creation (createcert) Utility

You may choose to purchase certificates from a third party. These certificate authorities (CAs) provide their own tools for creating certificates. You can use createcert to create certificates for development and testing; you can also use it for production certificates.

Syntax

createcert [options]

Parameters

[options] – these options are available through the createcert utility:

Option	Description
`-r`	Creates a PKCS #10 certificate request. createcert does not prompt for a signer or any other information used to sign a certificate.
`-s <filename>`	Signs the PKCS #10 certificate request that is in the specified file. The request can be DER or PEM encoded. createcert does not prompt for key generation or subject information.

Note:

To create a signed certificate, use createcert without options. To break the process into two separate steps, for example so one person creates a request and another person signs it, the first person can run createcert with -r to create a request and the second person can sign the request by running createcert with -s.

When you run createcert, you are asked for all or some of this information, depending on whether you specified -r or -s or neither.

Choose encryption type – select RSA.
Enter RSA key length (512-16384) – this prompt appears only if you chose RSA encryption. Specify a length between 512 bits and 16384 bits.
Subject information – enter this information, which identifies the entity:
- Country Code
- State/Province
- Locality
- Organization
- Organizational Unit
- Common Name
Enter file path of signer's certificate – (optional) supply a location and file name for the signer's certificate. If you supply this information, the generated certificate is a signed certificate. If you do not supply this information, the generated certificate is a self-signed root certificate.
Enter file path of signer's private key – supply a location and file name to save the private key associated with the certificate request. This prompt appears only if you supplied a file in the previous prompt.
Enter password for signer's private key – supply the password that was used to encrypt the signer's private key. Supply this password only if the private key was encrypted.
Serial number – (optional) supply a serial number. The serial number must be a hexadecimal string of 40 digits or less. This number must be unique among all certificates signed by the current signer. If you do not supply a serial number, createcert generates a GUID as the serial number.
Certificate will be valid for how many years (1-100) – specify the number of years that the certificate is valid. After this period, the certificate expires, along with all certificates it signs.
Certificate Authority (y)es or (n)o – indicate whether this certificate can be used to sign other certificates. By default, certificates are not certificate authorities (n).
Key usage – supply a comma-separated list of numbers that indicate how the certificate's private key can be used. The default, which depends on whether the certificate is a certificate authorty or not, should be acceptable for most situations.
File path to save request – this prompt appears only if you specify the -r option. Supply a location and file name for the PCKS10 certificate request. Supply a location and file name in which to save the certificate. The certificate is not saved unless you specify a location and file name.
Enter file path to save private key – supply a location and file name in which to save the private key. Enter a password to protect private key. Optionally, supply a password with which to encrypt the private key. If you do not supply a password, the private key is not encrypted. This prompt appears only if you supplied a file in the previous prompt.
Enter file path to save identity – supply a location and file name in which to save the identity. The identity file is a concatenation of the certificate, signer, and private key. This is the file that you supply to the server at start up. If the private key was not saved, createcert prompts for a password to save the private key. Otherwise, it uses the password provided earlier. The identity is not saved unless you provide a file name. If you do not save the identity file, you can manually concatenate the certificate, signer, and private key files into an identity file.

Examples

Example 1: Creating a signed certificate – This example creates a signed certificate. No file name is provided for the signer's certificate, which makes it a self-signed root certificate.

<UnwiredPlatform_InstallDir>\UnwiredPlatform\Servers\SQLAnywhere11\BIN32>createcert
SQL Anywhere X.509 Certificate Generator Version 11.0.1.2405
Enter RSA key length (512-16384): 1024
Generating key pair...
Country Code: US
State/Province: CA
Locality: Dublin
Organization: MyCompanyCA
Organizational Unit: PTO
Common Name: MyCompanyCA
Enter file path of signer's certificate:
Certificate will be a self-signed root
Serial number [generate GUID]:<enter>
Generated serial number: 3f52ee68c8604e48b8359e0c0128da5a
Certificate valid for how many years (1-100): 10
Certificate Authority (Y/N) [N]: Y
1.  Digital Signature
2.  Nonrepudiation
3.  Key Encipherment
4.  Data Encipherment
5.  Key Agreement
6.  Certificate Signing
7.  CRL Signing
8.  Encipher Only
9.  Decipher Only
Key Usage [6,7]: <enter>
Enter file path to save certificate: rsa_root.crt
Enter file path to save private key: rsa_key.key
Enter password to protect private key: <MyPwd>
Enter file path to save identity: id.pem

Example 2: Generating an enterprise root certificate – To generate an enterprise root certificate (a certificate that signs other certificates), a self-signed root certificate should be created with a CA. The procedure is similar to Example 1. However, the response to the CA prompt should be yes and choice for roles should be option 6,7 (the default).
```
Certificate Authority (Y/N) [N]: y
1.  Digital Signature
2.  Nonrepudiation
3.  Key Encipherment
4.  Data Encipherment
5.  Key Agreement
6.  Certificate Signing
7.  CRL Signing
8.  Encipher Only
9.  Decipher Only
Key Usage [6,7]: 6,7
```