Forum libero

Risolto così (a futura memoria):
nella directory /etc/nginx/keys dove teniamo i certificati, ho creato il file v3.ext con il contenuto:

authorityKeyIdentifier=keyid
basicConstraints=CA:TRUE
keyUsage=digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly
extendedKeyUsage=serverAuth

Credo di aver fatto un certificato coi superpoteri.
Poi ho creato una nuova ca:

$ sudo openssl genrsa -out ca.key 4096
Generating RSA private key, 4096 bit long modulus
....................................................................................................................................++
..............................++
e is 65537 (0x10001)
$ sudo openssl req -new -key ca.key -out ca.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:PI
State or Province Name (full name) [Some-State]:Sfizzeronia e dintorni
Locality Name (eg, city) []:Trollonia
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Forumdeitroll Non-profit trolling Ltd
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:ca.forumdeitroll.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
$ sudo openssl x509 -req -in ca.csr -out ca.crt -signkey ca.key
Signature ok
subject=/C=PI/ST=Sfizzeronia e dintorni/L=Trollonia/O=Forumdeitroll Non-profit trolling Ltd/CN=ca.forumdeitroll.com
Getting Private key

Infine ho creato il certificato del fdt e l'ho firmato:

$ sudo openssl genrsa -out webserver.key 4096
Generating RSA private key, 4096 bit long modulus
..++
..............................................................................................++
e is 65537 (0x10001)
$ sudo openssl req -new -key webserver.key -out webserver.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:PI
State or Province Name (full name) [Some-State]:Sfizzeronia e dintorni
Locality Name (eg, city) []:Trollonia
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Forumdeitroll Non-profit trolling Ltd
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:forumdeitroll.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
$ sudo mkdir -p demoCA/newcerts
$ sudo touch demoCA/index.txt
$ echo 01 | sudo tee demoCA/serial
01
$ sudo openssl ca -in webserver.csr -cert ca.crt -keyfile ca.key -out webserver.crt -days 3650 -extfile v3.ext
Using configuration from /usr/lib/ssl/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Oct 16 20:45:32 2014 GMT
            Not After : Oct 13 20:45:32 2024 GMT
        Subject:
            countryName               = PI
            stateOrProvinceName       = Sfizzeronia e dintorni
            organizationName          = Forumdeitroll Non-profit trolling Ltd
            commonName                = forumdeitroll.com
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                0.
            X509v3 Basic Constraints: 
                CA:TRUE
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
Certificate is to be certified until Oct 13 20:45:32 2024 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

That's all folks! Aggiungo questo post al segnalibro.