---
title: "Becoming a Certificate Authority"
canonical: "https://docs.cuesystem.com/space/HTBCA/465928195/Becoming%20a%20Certificate%20Authority"
format: markdown
---
# Creating a working folder

If you are working on a PC with Windows 10/11 and WSL 2, you have two options for running the following commands. You can either work in a Linux terminal (Ubuntu application) or you can work in the PowerShell console.

In Windows environment, create a working folder for the certificates, e.g. ***C:\cert*** at first.

#### **Linux terminal**: 

Windows drive C: is accessible in the Ubuntu terminal as the** *****/mnt/c/ ***folder. You can use the command   
***cd /mnt/c/cert**** *to change the directory in the Ubuntu terminal to your working one.

#### **PowerShell**: 

Use the PowerShell command ***cd C:\cert**** *to change the directory in the PowerShell to your working one.

The following commands are the same for Linux terminal and for Windows PowerShell, the only difference being that if you are using PowerShell, you must precede all commands with a ***wsl**** *statement.

For example, in the Ubuntu terminal you enter: ***openssl genrsa -des3 -out myCA.key 2048***,*** ***  
in the PowerShell you enter: ***wsl openssl genrsa -des3 -out myCA.key 2048***.

If you are working on a PC running Linux or a virtual machine, you will run the following commands in a Linux terminal. The following examples will be for the fictitious company Contoso. In your particular case, choose file names to match your company standard. Examples of file names are highlighted in red in the following text.

# Creating Certification Authority

It‘s amazing how easy it is to generate the files needed to become a certification authority. It only takes two commands. We will first generate our private key named <span style="color: #ff5630">ContosoCAPrivateKey.key:</span>

- ***openssl genrsa -des3 -out ***<span style="color: #ff5630">***ContosoCAPrivateKey.key***</span>*** 2048***

You will be prompted for a passphrase, which we recommend not skipping and keeping safe. The passphrase will prevent anyone who gets your private key from generating a root certificate of their own. The output should look like this:

![image](media://8790c4c9-1d9b-4cbc-8a25-1373f3f3fecc)

Keep the private key and passphrase in a safe place.

Then we generate a root certificate <span style="color: #ff5630">ContosoCARootCertificate.pem</span>:

- ***openssl req -x509 -new -nodes -key ***<span style="color: #ff5630">***ContosoCAPrivateKey.key***</span>*** -sha256 -days 1825 -out ***<span style="color: #ff5630">***ContosoCARootCertificate.pem***</span>* *

<span style="color: #ff5630">ContosoCAPrivateKey.key</span> in this command replace with your private key file. In the <span style="color: #ff5630">days </span>parameter, enter the number of days that the certificate will be valid, 1825 days = 5 years.

You will be prompted for the passphrase of your private key (that you just choose) and a bunch of questions. The answers to those questions aren’t that important. They show up when looking at the certificate, which you will almost never do. We suggest making the Common Name something that you’ll recognize as your root certificate in a list of other certificates. That’s really the only thing that matters.

![image](media://94a53399-407e-4e8c-800a-f26ced9694c1)

You should now have two files: <span style="color: #ff5630">ContosoCAPrivateKey.key</span> (your private key) and <span style="color: #ff5630">ContosoCARootCertificate.pem</span> (your root certificate) in our working directory.

Continue with [https://cue.atlassian.net/wiki/spaces/HTBCA/pages/480673868](https://cue.atlassian.net/wiki/spaces/HTBCA/pages/480673868)