Using OpenSSL to create a test Qualified Subordination PKI hierarchy

This post is from 2012. Some details, links, and recommendations may be out of date.

The other day posted about “Least Privilege and Subordinate Certificate Authorities”, this post talked about how you can delegate only a limited set of rights to a subordinate CA. I thought you might find a set of configuration files and batch files I put together to test these scenarios useful, here you go.

I threw this together on a Windows machine that had the Shinning Light OpenSSL distribution on it, it has several batch files:

CleanPKI.bat - Remove all generated content
MakePKI.bat - Make a new PKI

Then there is the OpenSSL configuration files, most of this is straight forward but for the stuff that is not check out the OpenSSL documentation.