一個由匹配證書公鑰的私鑰簽名的證書稱為 自簽名 證書。根證書頒發機構 （Root certification authority，CA） 證書就屬于這一類。用戶證書通常是由不同的私鑰簽名的，如 CA 的私鑰。這構成了兩證書鏈。驗證用戶證書為真涉及驗證其證書中的簽名，這需要 CA 的公鑰。但在在可以使用 CA 的公鑰之前，需要對封裝的 CA 證書進行驗證。因為 CA 證書是自簽名的，所以用 CA 公鑰驗證證書。
用戶證書需要用根 CA 的私鑰簽名。它可以用一個中介的私鑰簽名，這個私鑰的證書是用 CA 的私鑰簽名的。這是一個三證書鏈的例子：用戶證書、中介證書和 CA 證書。但是在鏈中可以有多個中介，因此證書鏈可以有任意的長度。
創建根證書 CA shell 腳本使創建根證書成為一項相對輕易的工作。首先，進入要存放 CA 數據的目錄。 （我使用 temp/OpenSSL 目錄。） 然后鍵入：
CA -newca
這會產生一個像清單 1 的對話框，它包括我在提示符下輸入的示例信息：
清單 1. 創建根證書
$ CA.sh -newca CA certificate filename (or enter to create)
Making CA certificate ... Using configuration from C:/PROGRA~1/MKSTOO~1/etc/openssl/openssl.cnf Loading 'screen' into random state - done Generating a 1024 bit RSA private key ......++++++ ...++++++ writing new private key to './demoCA/private/./cakey.pem' Enter PEM pass phrase: Verifying passWord - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. You will see a number of fields, but you can leave some blank. For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:UK State or Province Name (full name) [Some-State]:Hampshire Locality Name (e.g., city) []:Winchester Organization Name (e.g., company) [Internet Widgits Pty Ltd]:IBM UK Ltd Organizational Unit Name (e.g., section) []:JTC Common Name (e.g., YOUR name) []:Pauls Root Certificate Email Address []:Paul_Abbott@uk.ibm.com $
Using configuration from C:/PROGRA~1/MKSTOO~1/etc/openssl/openssl.cnf Loading 'screen' into random state - done Generating a 1024 bit RSA private key ......................++++++ ...++++++ writing new private key to 'newreq.pem' Enter PEM pass phrase: Verifying password - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. You will see a number of fields, but you can leave some blank. For some fields there will be a default value. If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:UK State or Province Name (full name) [Some-State]:Hampshire Locality Name (e.g., city) []:Winchester Organization Name (e.g., company) [Internet Widgits Pty Ltd]:IBM Uk Ltd Organizational Unit Name (e.g., section) []:JET Common Name (e.g., YOUR name) []:Paul Abbott Email Address []:Paul_H_Abbott@uk.ibm.com
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:qwerty An optional company name []: Request (and private key) is in newreq.pem
對請求簽名 執行 CA -sign 命令會用包含在 private/cakey.pem 中的根 CA 的私鑰簽名請求。請求需要在一個名為 newreq.pem 的文件中，生成的證書寫入到名為 newcert.pem 的文件中，這兩個文件都在當前目錄中。清單 3 顯示了示例請求-簽名對話框。
清單 3. 示例 -sign 對話框
$ CA.sh -sign Using configuration from C:/PROGRA~1/MKSTOO~1/etc/openssl/openssl.cnf Loading 'screen' into random state - done Enter PEM pass phrase: Check that the request matches the signature Signature ok The Subjects Distinguished Name is as follows countryName :PRINTABLE:'UK' stateOrProvinceName :PRINTABLE:'Hampshire' localityName :PRINTAB
