{"id":18561567,"url":"https://github.com/sarcasticadmin/simple-tls-example","last_synced_at":"2026-07-17T01:32:35.740Z","repository":{"id":87532362,"uuid":"175516132","full_name":"sarcasticadmin/simple-tls-example","owner":"sarcasticadmin","description":"Simple example of how to use a CA and server cert","archived":false,"fork":false,"pushed_at":"2019-03-13T23:49:28.000Z","size":3,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-10-11T14:33:00.628Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sarcasticadmin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-03-13T23:49:01.000Z","updated_at":"2019-03-13T23:49:29.000Z","dependencies_parsed_at":"2023-03-13T18:44:38.359Z","dependency_job_id":null,"html_url":"https://github.com/sarcasticadmin/simple-tls-example","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sarcasticadmin/simple-tls-example","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sarcasticadmin%2Fsimple-tls-example","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sarcasticadmin%2Fsimple-tls-example/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sarcasticadmin%2Fsimple-tls-example/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sarcasticadmin%2Fsimple-tls-example/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sarcasticadmin","download_url":"https://codeload.github.com/sarcasticadmin/simple-tls-example/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sarcasticadmin%2Fsimple-tls-example/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35563613,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-16T02:00:06.687Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-06T22:07:17.544Z","updated_at":"2026-07-17T01:32:35.722Z","avatar_url":"https://github.com/sarcasticadmin.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TLS\n\nA simple guide into how to use it. We will be leveraging `openssl` and `cfssl`.\nUnfortunately I did not lean completely on `cfssl` as it makes things a bit too\nmagically for a detailed explanation about whats going on.\n\n## Reqs\n\nInstall the following:\n\n* cfssl\n* cfssljson\n* python3\n\n## Certificate Authority\n\nValidate that everything in ca.json is valid:\n\n```\nview ca.json\n```\n\nCreate the private public key for the `ca`:\n\n```sh \n$ cd ca\n$ cfssl gencert -initca ca.json | cfssljson -bare ca\n$ rm ca.csr\n$ mv ca-key.pem ca.priv\n$ mv ca.pem ca.pub\n```\n\u003e NOTE: Usually this is more than one step with openssl but cfssl\n\u003e streamlines the process\n\n## Server Cert\n\nGo into the following dir:\n\n```sh\ncd ../cert1\n```\n\nGenerate a private key that 2048 bits in size:\n\n```sh\nopenssl genrsa -out coolapi.priv 2048\n```\n\nValidate config in config file for csr generation:\n\n```sh\nvim coolapi.conf\n```\n\nGenerate the `csr`:\n\n```sh\nopenssl req -new -config coolapi.conf -key coolapi.priv -out coolapi.csr\n```\n\nDouble check that the `csr` contains the expected values:\n\n```sh\nopenssl req -in coolapi.csr -noout -text -nameopt sep_multiline\n```\n\nProvide the generated coolapi.csr to the CA to issue our cert!\n\n## Generate crt\n\nGo to `ca` dir:\n\n```sh\ncd ../ca\nmkdir sign-cert1\ncd sign-cert1\n```\n\nCopy in `csr` that was generated:\n\n```sh\ncp ../../cert1/coolapi.csr .\n```\n\nGenerate the `crt` for `coolapi.nebulaworks.com`:\n\n```sh\ncfssl sign -ca=../ca.pub -ca-key=../ca.priv ./coolapi.csr | cfssljson -bare coolapi\nmv coolapi.pem coolapi.crt\n```\n\nVerify that the cert indeed came from the `ca`:\n\n```sh\n$ openssl verify -verbose -CAfile ../ca.pub coolapi.crt\ncoolapi.crt\n```\n\nCopy `coolapi.crt` back to cert1 folder along with the `ca.pub` public key\n\n### Enabling the service\n\nGo to the `cert1` dir:\n\n```sh\ncd cert1\n```\n\nValidate that the cert came from your private key:\n\n```sh\nopenssl x509 -noout -modulus -in coolapi.crt | openssl md5\nopenssl rsa -noout -modulus -in coolapi.priv | openssl md5\n```\n\u003e Note both outputs should match\n\nCreate a combo file with both the `private` and `cert` file together:\n\n```sh\ncat coolapi.priv coolapi.crt \u003e coolapi.combo \n```\n\nRun the webserver:\n\n```sh\npython3 webserver.py\n```\n\nYou now have a TLS server running on `127.0.0.1`\n\n## Testing\n\nWith the webserver running, attempt to `curl` it:\n\n```sh\n$ curl https://127.0.0.1:4443\ncurl: (60) SSL certificate problem: unable to get local issuer certificate                                            \nMore details here: https://curl.haxx.se/docs/sslcerts.html\n```\n\nWe got an error because we did not pass the `ca` public key for curl since it isnt in our default trust list:\n\n```sh\n$ curl --cacert ca/ca.pub https://127.0.0.1:4443\n\u003c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\" \"http://www.w3.org/TR/html4/strict.dtd\"\u003e\n\u003chtml\u003e\n...\n```\n\nYay the valid response we wanted!\n\n## Conclusion\n\n* We were able to generate our own certificate authority\n* We were able to generate a server private key\n* We were able to generate a server certificate signing request\n* We signed that certificate request using our own CA\n* Validated that the certificate was generate with that CA\n* Validated that the certificate signed by the CA was indeed for our server private key\n* Tested the key out with a simple webserver and curl\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsarcasticadmin%2Fsimple-tls-example","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsarcasticadmin%2Fsimple-tls-example","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsarcasticadmin%2Fsimple-tls-example/lists"}