Securing a networked system Implementing TLS on HTTP for HTTPS:// using xampp OpenSSl in windows

Step1:DNS Configuration:
hosts:
127.0.0.1 localhost
127.0.0.1 acmesecureserver
127.0.0.1 www.acmesecureserver.com
xampp→apache→conf→
httpd.conf:
DocumentRoot "C:/acmesecureserver"
Directory "C:/acmesecureserver"

Step2: Creating certificate:
Configuring httpd-vhosts:
**VirtualHost *:443
DocumentRoot "C:/acmesecureserver/"
ServerName acmesecureserver
ServerAlias www.acmesecureserver.com
SSLEngine on
SSLCertificateFile "conf/ssl.crt/server.crt"
SSLCertificateKeyFile "conf/ssl.key/server.key"
/VirtualHost** (Use angle bracket for every TAG)

domain.ext:
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
subjectAltName = @alt_names
[alt_names]
DNS.1 =www.acmesecureserver.com
DNS.2 =127.0.0.1
root.ext:
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:TRUE
subjectAltName = @alt_names
[alt_names]
DNS.1 =www.acmesecureserver.com
DNS.2 =127.0.0.1

Step3:
For openssl environment path configuration:
set OPENSSL_CONF=C:\xampp\apache\conf\openssl.cnf

For creating a server certificate→
~ req -newkey rsa:2048 -nodes -keyout server.key -out server.csr
~ x509 -signkey server.key -in server.csr -req -days 365 -out server.crt

For creating a sub root CA certificate→
~ req -newkey rsa:2048 -keyout subrootCA.key -out subrootCA.csr
~ x509 -signkey subrootCA.key -in subrootCA.csr -req -days 365 -out subrootCA.crt

For creating a root CA certificate→
~ req -x509 -sha256 -days 1825 -newkey rsa:2048 -keyout rootCA.key -out rootCA.crt

Signing subrootCA certificate with rootCA certificate→
~ x509 -req -CA rootCA.crt -CAkey rootCA.key -in subrootCA.csr -out subrootCA.crt -days 365 -CAcreateserial -extfile root.ext

For checking the subrootCa certificate→
~ x509 -text -noout -in subrootCA.crt

Exporting the subrootCA key file in subrootCA pfx file→
~ pkcs12 -inkey subrootCA.key -in subrootCA.crt -export -out subrootCA.pfx

Signing server certificate with subrootCA certificate→
~ x509 -req -CA subrootCA.crt -CAkey subrootCA.key -in server.csr -out server.crt -days 365 -CAcreateserial -extfile domain.ext

For checking the server certificate→
~ x509 -text -noout -in server.crt

Exporting the server key file in the server .pfx file→
~ pkcs12 -inkey server.key -in server.crt -export -out server.pfx

Replacing the RSA encryption from the server and subrootCA key for setting the validity→
~ rsa -in server.key -out server.key
~ rsa -in subrootCA.key -out subrootCA.key


Ste3: Revocation of certificate:

Open openssl.exe to revoke the certificate issued to acmesecureserver.com from the AcmeCA →
ca -config subrootCA.conf -revoke server.crt

To generate revocation crl file →
ca -config subrootCA.conf -gencrl -out rev.crl

To see the revocation file in the form of text →
crl -in rev.crl -noout -text