Certificate Creation (createcert) Utility

You may choose to purchase certificates from a third party. These certificate authorities (CAs) provide their own tools for creating certificates. You can use createcert to create certificates for development and testing; you can also use it for production certificates.

Syntax

createcert [options]

Parameters

[options] – these options are available through the createcert utility:

Option	Description
`-r`	Creates a PKCS #10 certificate request. createcert does not prompt for a signer or any other information used to sign a certificate.
`-s <filename>`	Signs the PKCS #10 certificate request that is in the specified file. The request can be DER or PEM encoded. createcert does not prompt for key generation or subject information.

Note: To create a signed certificate, use createcert without options. To break the process into two separate steps, for example so one person creates a request and another person signs it, the first person can run createcert with -r to create a request and the second person can sign the request by running createcert with -s.

When you run createcert, you are asked for all or some of this information, depending on whether you specified -r, -s, or neither.

Choose encryption type – select RSA.
Enter RSA key length (512-16384) – this prompt appears only if you chose RSA encryption. Specify a length between 512 bits and 16384 bits.
Subject information – enter this information, which identifies the entity:
- Country Code
- State/Province
- Locality
- Organization
- Organizational Unit
- Common Name
(Optional) Enter file path of signer's certificate – supply a location and file name for the signer's certificate. If you supply this information, the generated certificate is a signed certificate. If you do not supply this information, the generated certificate is a self-signed root certificate.
Enter file path of signer's private key – supply a location and file name to save the private key associated with the certificate request. This prompt appears only if you supplied a file in the previous prompt.
Enter password for signer's private key – supply the password that was used to encrypt the signer's private key. Supply this password only if the private key was encrypted.
(Optional) Serial number – supply a serial number. The serial number must be a hexadecimal string of 40 digits or less. This number must be unique among all certificates signed by the current signer. If you do not supply a serial number, createcert generates a GUID as the serial number.
Certificate will be valid for how many years (1-100) – specify the number of years for which the certificate is valid. After this period, the certificate expires, along with all certificates it signs.
Certificate Authority (y)es or (n)o – indicate whether this certificate can be used to sign other certificates. The default value is no.
Key usage – supply a comma-separated list of numbers that indicate the ways in which the certificate's private key can be used. The default, which depends on whether the certificate is a certificate authority, should be acceptable for most situations.
File path to save request – this prompt appears only if you specify the -r option. Supply a location and file name for the PCKS #10 certificate request. Supply a location and file name in which to save the certificate. The certificate is not saved unless you specify a location and file name.
Enter file path to save private key – supply a location and file name in which to save the private key. Enter a password to protect private key. Optionally, supply a password with which to encrypt the private key. If you do not supply a password, the private key is not encrypted. This prompt appears only if you supplied a file in the previous prompt.
Enter file path to save identity – supply a location and file name in which to save the identity. The identity file is a concatenation of the certificate, signer, and private key. This is the file that you supply to the server at start-up. If the private key was not saved, createcert prompts for a password to save the private key. Otherwise, it uses the password provided earlier. The identity is not saved unless you provide a file name. If you do not save the identity file, you can manually concatenate the certificate, signer, and private key files into an identity file.

Examples

Example 1: – creates a self-signed certificate. No file name is provided for the signer's certificate, which makes it a self-signed root certificate.

SUP_HOME\UnwiredPlatform\Servers\SQLAnywhereXX\BINXX>createcert
SQL Anywhere X.509 Certificate Generator Version xx.xx.xx.xx
Enter RSA key length (512-16384): 1024
Generating key pair...
Country Code: US
State/Province: CA
Locality: Dublin
Organization: MyCompanyCA
Organizational Unit: PTO
Common Name: MyCompanyCA
Enter file path of signer's certificate:
Certificate will be a self-signed root
Serial number [generate GUID]:<enter>
Generated serial number: 3f52ee68c8604e48b8359e0c0128da5a
Certificate valid for how many years (1-100): 10
Certificate Authority (Y/N) [N]: Y
1.  Digital Signature
2.  Nonrepudiation
3.  Key Encipherment
4.  Data Encipherment
5.  Key Agreement
6.  Certificate Signing
7.  CRL Signing
8.  Encipher Only
9.  Decipher Only
Key Usage [6,7]: <enter>
Enter file path to save certificate: rsa_root.crt
Enter file path to save private key: rsa_key.key
Enter password to protect private key: <MyPwd>
Enter file path to save identity: id.pem

Example 2: Generating an enterprise root certificate – to generate an enterprise root certificate (a certificate that signs other certificates), create a self-signed root certificate with a CA. The procedure is similar to Example 1. However, the response to the CA prompt should be yes and choice for roles should be option 6,7 (the default).
```
Certificate Authority (Y/N) [N]: y
1.  Digital Signature
2.  Nonrepudiation
3.  Key Encipherment
4.  Data Encipherment
5.  Key Agreement
6.  Certificate Signing
7.  CRL Signing
8.  Encipher Only
9.  Decipher Only
Key Usage [6,7]: 6,7
```