Creating a self-signed certificate

You'd think that creating a self-signed certificate wouldn't be hard to do. It might not be too hard if you ask Google the right question, but somehow I asked questions that led me into the deep, deep woods.
And all I was trying to do was sign my time sheet!
I mean, I would have thought there was some utility on my program called "MakeCert" that would create such a cert. And maybe there is. But I went the hard way around. If you're looking for the easy answer rather than a record of my painful journey, skip to the end. If not, then read on. The Hard Way

The Hard way

Again, you don't have to read this. It's painful. At least it was for me. But if, like me, you are a glutton for punishment, then, yeah, go ahead. Read on.
Like I said, I was just trying to sign my time sheet electronically. To do that, Open Office kindly I just needed to install a certificate. Easy, peasy! So, lost in the mists of time, my first question to Google, or possibly to Open Office help was: "How do you install a certificate."
Easy, the answer came back. Just install it using Firefox.
That completely makes sense. I mean if you are going to install a certificate for a spreadsheet, of course you'd want to go to your browser to do it.
Never mind.
My next question, of course was: how do you do that? The answer, at Red Hat's site, is here. But that, of course assumes that you have a certificate. How do you get one. Somehow, unfortunately, I ended up here. Or maybe I started here and went to Firefox. Never mind. Whichever way the arrow of causality pointed, it pointed to the wrong place.
See, because you can't just produce a self-signed cert. It's more complicated. Way more.
Because in order to self-sign a cert you have to be a certification authority. It's not hard, but it's an extra step. You have to create a certificate that says you are a certification authority (CA), is all. Then you can tell your browser to trust certificates signed by yourself. Then you provide a certificate. And done.
But no. You can't just sign a certificate. Why? Because you need a certificate signing request first. I mean no legitimate CA would sign a certificate without a request, and so you can't either. It feels like hall passes in high school. But never mind.
So I create a certificate signing request, which has to be signed by the signing authority that's going to sign the certificate. And once you've done that, once you have official proof that you can give the signing authority that you've officially asked for permission for it to sign your certificate, well, then, and only then it (meaning you) will the CA sign it.
Fine. So now I've gone through all three stepsand I've got my cert. Now all I have to do is tell Firefox about it. Right?
Wrong. Firefox will accept my the certificate for my self-signing certificate authority. So if there was a personal certificate that it could import, it would say: "Wow cool! I know the CA for this cert, and import it. But Firefox likes certs in PKCS12 format and my cert, according to the instructions at this earlier referenced page, is in X509 format. Apparently that's the kind of self-signed cert you'd give Apache or some other web server to serve pages security. But it ain't what Firefox wants. No.
So how do you (or rather I, you being too smart do go through all this shit) turn your (my) X509 cert into a PKCS12 cert? Ya wanna know? Well, back down the rat hole was go.
The source for the information in this earlier referenced page is the SSL certificate How To, which tells you how to create a PKCS12 cert so you can sign your email. All you have to do is run the CA.pl utility and... what? You don't have a CA.pl utility? Well actually you do, if you hunt around. Hint: it's in /usr/lib/ssl. Really? Not there? Well, maybe it's in a subdirectory. I won't tell you which one, but trust me (or not.) It's there.
Now running the utility is pretty easy. But to make it easy you have to do hard stuff. Like modifying the file /usr/sbin/CA.pl, which looks kinda like this:

           =#$SSLEAY_CONFIG=$ENV{"SSLEAY_CONFIG"};
            $SSLEAY_CONIG="-config /etc/openssl.cnf";
            #$CATOP="./demoCA";
            $CATOP="/var/ssl";

That's not so bad, you say. A couple of lines of shell script so that you type things like

            CA.pl -newcert

instead of things like:

           (openssl req -config /etc/openssl.cnf -new -x509 -keyout newreq.pem \
            -out newreq.pem -days 365)

That's a fair bargain. If that was the deal.
But it's not.
No. It's not that easy. We're just getting started. What you have to do, in order to save yourself that small amount of trouble is customize this configurationfile.

            #---Begin---
            #
            # OpenSSL example configuration file.
            # This is mostly being used for generation of certificate requests.
            #
            RANDFILE  = $ENV::HOME/.rnd
            oid_file  = $ENV::HOME/.oid
            oid_section  = new_oids
            # To use this configuration file with the "-extfile" option of the
            # "openssl x509" utility, name here the section containing the
            # X.509v3 extensions to use:
            # extensions  =
            # (Alternatively, use a configuration file that has only
            # X.509v3 extensions in its main [= default] section.)
            [ new_oids ]
            # We can add new OIDs in here for use by 'ca' and 'req'.
            # Add a simple OID like this:
            # testoid1=1.2.3.4
            # Or use config file substitution like this:
            # testoid2=${testoid1}.5.6
            ####################################################################
            [ ca ]
            default_ca = CA_default  # The default ca section
            ####################################################################
            [ CA_default ]
            dir             = /var/ssl                # Where everything is kept
            certs           = $dir/certs              # Where the issued certs are kept
            crl_dir         = $dir/crl                # Where the issued crl are kept
            database        = $dir/index.txt          # database index file.
            new_certs_dir   = $dir/newcerts           # default place for new certs.
            certificate     = $dir/cacert.pem         # The CA certificate
            serial          = $dir/serial             # The current serial number
            crl             = $dir/crl.pem            # The current CRL
            private_key     = $dir/private/cakey.pem  # The private key
            RANDFILE        = $dir/private/.rand      # private random number file
            x509_extensions = usr_cert                # The extentions to add to the cert
            # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
            # so this is commented out by default to leave a V1 CRL.
            # crl_extensions = crl_ext
            default_days    = 365                     # how long to certify for
            default_crl_days= 7                       # how long before next CRL
            default_md      = sha1                    # which md to use.
            preserve        = no                      # keep passed DN ordering
            # A few difference way of specifying how similar the request should look
            # For type CA, the listed attributes must be the same, and the optional
            # and supplied fields are just that :-)
            policy  = policy_match
            # For the CA policy
            [ policy_match ]
            countryName            = match
            stateOrProvinceName    = optional
            localityName           = match
            organizationName       = match
            organizationalUnitName = optional
            commonName             = supplied
            emailAddress           = optional
            # For the 'anything' policy
            # At this point in time, you must list all acceptable 'object'
            # types.
            [ policy_anything ]
            countryName            = optional
            stateOrProvinceName    = optional
            localityName           = optional
            organizationName       = optional
            organizationalUnitName = optional
            commonName             = supplied
            emailAddress           = optional
            ####################################################################
            [ req ]
            default_bits       = 1024
            default_keyfile    = privkey.pem
            distinguished_name = req_distinguished_name
            attributes         = req_attributes
            default_md         = sha1
            x509_extensions    = v3_ca # The extentions to add to the self signed cert
            # Passwords for private keys if not present they will be prompted for
            # input_password = secret
            # output_password = secret
            # This sets a mask for permitted string types. There are several options.
            # default: PrintableString, T61String, BMPString.
            # pkix : PrintableString, BMPString.
            # utf8only: only UTF8Strings.
            # nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
            # MASK:XXXX a literal mask value.
            # WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
            # so use this option with caution!
            string_mask = nombstr
            # req_extensions = v3_req # The extensions to add to a certificate request
            [ req_distinguished_name ]
            countryName         = Country Name (2 letter code)
            countryName_default = FJ
            countryName_min     = 2
            countryName_max     = 2

            stateOrProvinceName         = State or Province Name (full name)
            stateOrProvinceName_default = Fiji
            localityName          = Locality Name (eg, city)
            localityName_default  = Suva
            0.organizationName         = Organization Name (eg, company)
            0.organizationName_default = SOPAC
            # we can do this but it is not needed normally :-)
            #1.organizationName         = Second Organization Name (eg, company)
            #1.organizationName_default = World Wide Web Pty Ltd
            organizationalUnitName         = Organizational Unit Name (eg, section)
            organizationalUnitName_default = ITU
            commonName       = Common Name (eg, YOUR name)
            commonName_max   = 64
            emailAddress     = Email Address
            emailAddress_max = 40
            # SET-ex3   = SET extension number 3
            [ req_attributes ]
            challengePassword     = A challenge password
            challengePassword_min = 4
            challengePassword_max = 20
            unstructuredName      = An optional company name
            [ usr_cert ]
            # These extensions are added when 'ca' signs a request.
            # This goes against PKIX guidelines but some CAs do it and some software
            # requires this to avoid interpreting an end user certificate as a CA.
            basicConstraints=CA:FALSE
            # Here are some examples of the usage of nsCertType. If it is omitted
            # the certificate can be used for anything *except* object signing.
            # This is OK for an SSL server.
            # nsCertType   = server
            # For an object signing certificate this would be used.
            # nsCertType = objsign
            # For normal client use this is typical
            # nsCertType = client, email
            # and for everything including object signing:
            # nsCertType = client, email, objsign
            # This is typical in keyUsage for a client certificate.
            # keyUsage = nonRepudiation, digitalSignature, keyEncipherment
            # This will be displayed in Netscape's comment listbox.
            nsComment  = "Certificate issued by https://www.sopac.org/ssl/"
            # PKIX recommendations harmless if included in all certificates.
            subjectKeyIdentifier=hash
            authorityKeyIdentifier=keyid,issuer:always
            # This stuff is for subjectAltName and issuerAltname.
            # Import the email address.
            # subjectAltName=email:copy
            # Copy subject details
            # issuerAltName=issuer:copy
            # This is the base URL for all others URL addresses
            # if not supplied
            nsBaseUrl  = https://www.sopac.org/ssl/
            # This is the link where to download the latest Certificate
            # Revocation List (CRL)
            nsCaRevocationUrl = https://www.sopac.org/ssl/sopac-ca.crl
            # This is the link where to revoke the certificate
            nsRevocationUrl  = https://www.sopac.org/ssl/revocation.html?
            # This is the location where the certificate can be renewed
            nsRenewalUrl  = https://www.sopac.org/ssl/renewal.html?
            # This is the link where the CA policy can be found
            nsCaPolicyUrl  = https://www.sopac.org/ssl/policy.html
            # This is the link where we can get the issuer certificate
            issuerAltName = URI:https://www.sopac.org/ssl/sopac.crt
            # This is the link where to get the latest CRL
            crlDistributionPoints = URI:https://www.sopac.org/ssl/sopac-ca.crl
            [ v3_ca ]
            # Extensions for a typical CA
            # PKIX recommendation.

            subjectKeyIdentifier=hash
            authorityKeyIdentifier=keyid:always,issuer:always
            # This is what PKIX recommends but some broken software chokes on critical
            # extensions.
            # basicConstraints = critical,CA:true
            # So we do this instead.
            basicConstraints = CA:true
            # Key usage: this is typical for a CA certificate. However since it will
            # prevent it being used as an test self-signed certificate it is best
            # left out by default.
            # keyUsage = cRLSign, keyCertSign
            # Some might want this also
            # nsCertType = sslCA, emailCA
            # Include email address in subject alt name: another PKIX recommendation
            # subjectAltName=email:copy
            # Copy issuer details
            # issuerAltName=issuer:copy
            # RAW DER hex encoding of an extension: beware experts only!
            # 1.2.3.5=RAW:02:03
            # You can even override a supported extension:
            # basicConstraints= critical, RAW:30:03:01:01:FF
            # This will be displayed in Netscape's comment listbox.
            nsComment  = "Certificate issued by https://www.sopac.org/ssl/"
            # This is the base URL for all others URL addresses
            # if not supplied
            nsBaseUrl  = https://www.sopac.org/ssl/
            # This is the link where to download the latest Certificate
            # Revocation List (CRL)
            nsCaRevocationUrl = https://www.sopac.org/ssl/sopac-ca.crl
            # This is the link where to revoke the certificate
            nsRevocationUrl  = https://www.sopac.org/ssl/revocation.html?
            # This is the location where the certificate can be renewed
            nsRenewalUrl  = https://www.sopac.org/ssl/renewal.html?
            # This is the link where the CA policy can be found
            nsCaPolicyUrl  = https://www.sopac.org/ssl/policy.html
            # This is the link where we can get the issuer certificate
            issuerAltName = URI:https://www.sopac.org/ssl/sopac.crt
            # This is the link where to get the latest CRL
            crlDistributionPoints = URI:https://www.sopac.org/ssl/sopac-ca.crl
            [ crl_ext ]
            # CRL extensions.
            # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
            # issuerAltName=issuer:copy
            authorityKeyIdentifier=keyid:always,issuer:always
            #----End----

Yowch! A this point, my eyes start to bleed.
And then, wisely, I give up.

The Easy Way

Hi! Those of us who took the long way round are happy to join you here, where the saga continues, right after I, wisely, and almost finally, give up.
But before I give up entirely I decide to take one last bit of the apple, swing from home plate, or insert your own lame metaphor here I make the correct search:

            utility to create self signed certificate

And voila! Just like that, I've got a couple of web sites that will do the whole job for you. Just plunk your information in the form. And once again, voila! All the certs are there for the plucking. Or they would have been if I hadn't decided that, having found the shortcut after wasting hours on the original long way round, I quit.
Next time I have to get a self-signed cert I'll try the shortcut and let you and me know how it turns out.
For now, at least, the madness is over.