< Back to Projects

Public Key Infrastructure with OpenSSL

School - ESGI M1 SI Solo August 2025 Completed

A series of three labs building, step by step, a complete public key infrastructure with OpenSSL: creating a certificate authority, generating real client and server certificates, and exporting them in .p12 format for actual use in mutual authentication.

PKI hierarchy and mutual authentication Root CA ca.cnf, private key Server certificate server.conf Client certificate client.conf, .p12 Mutual authentication (mTLS)
A root certificate authority signs a server certificate and a client certificate, exported as PKCS#12 for mutual authentication.

Context

Three consecutive labs from the M1 Information Security curriculum, focused on manually building a PKI with OpenSSL rather than using a managed one. The goal was to understand every step of the trust chain: key generation, certificate signing request, signing by the authority, and export into a format usable by a real application.

What was built

  • Full OpenSSL configuration for the certificate authority (ca.cnf).
  • Server certificate generated with its own configuration (server.conf).
  • Client certificate generated with its own configuration (client.conf).
  • Certificates exported in PKCS#12 (.p12) format, directly importable into a browser or client for mutual authentication.
  • Three lab submissions (TP1_HILALOGLU_Mustapha, TP2_HILALOGLU_Mustapha, TP3_M_H) documenting the progression.

Tech stack

OpenSSL X.509 PKCS#12 Certificate authority mTLS

Status

Completed and submitted. These PKI foundations were reused and extended later in the Linux hardening lab (building an in-house PKI to secure nginx over HTTPS and mTLS), see the dedicated ANSSI Linux hardening page.

< All projects