ugarbe.de
← Back to home

Certificate Creator user manual

← Certificate Creator overview

ClassifyIt.eu X.509 Certificate Creator

Original Certificate Creator icon unavailable at its source (HTTP 404).

User Manual

Version 1.2

Powered by OpenSSL 3.x and Delphi

Download: CertCreator/setup-CertCreator(v1.2).exe

Certificate Creator Tool

To support modern cryptographic needs, I provide a tool that allows you to create X.509 certificates using either ECC (Elliptic Curve Cryptography) or RSA algorithms, giving flexibility between performance and compatibility depending on your use case.

Download: Setup for Certificate Creator

 

Changes from Version 1.1 to 1.2

X.509 Introduction

X.509 certificates are digital certificates used to verify the identity of entities on a network, such as websites, servers, services, users, or certificate authorities. They are a central part of public key infrastructure (PKI): a certificate binds a public key to an identity and is signed by an issuer so that other systems can verify the binding.

Each certificate belongs to a key pair. The public key is included in the certificate and can be shared. The private key must remain secret and is used to create digital signatures or decrypt data, depending on the certificate purpose. If the private key is compromised, the certificate can no longer be trusted.

Certificates contain attributes such as subject, issuer, serial number, validity period, public key, and X.509 extensions. They are used by TLS/HTTPS, mutual TLS, S/MIME email protection, code signing, OCSP, and other security protocols.

1. Introduction

The ClassifyIt.eu X.509 Certificate Creator is a Windows desktop application for creating, signing, exporting, and inspecting X.509 certificates. It supports RSA and Elliptic Curve Cryptography (ECC), self-signed certificates, CA-signed certificates, root CA certificates, intermediate CA certificates, and end-entity certificates.

All cryptographic operations are performed locally with OpenSSL 3.x. No internet connection is required.

Key Features

System Requirements

2. Application Layout

The application uses three main tabs and a bottom action bar.

Tab 1: Certificate

This is the main certificate creation tab. It contains:

The private key is generated automatically when you click Generate Certificate. Manual key generation is still available as a quick test/action, but the final certificate generation always creates a fresh key that matches the current RSA/ECC settings.

Tab 2: Output

The Output tab contains file names and export options:

When you manually enter or change the email address on the Certificate tab, the certificate, key, PFX, CSR, and friendly-name fields on the Output tab are updated from that email address. Loading attributes from an existing CSR or certificate does not change the output file names.

All generated files are saved into the configured Certificate Store directory. Enter file names only, not full paths. If a selected output file already exists, the application warns before overwriting it.

Tab 3: Certificate Store

The Certificate Store tab manages the folder used by the application:

The store directory is persisted in the Windows registry and restored when the application starts.

3. Creating a Certificate

Step 1: Select the Key Type

Choose RSA or ECC in the Key Settings group.

RSA is widely compatible and useful for legacy systems. RSA 2048 is acceptable for many end-entity certificates. RSA 4096 is common for CA certificates or longer-lived internal use.

ECC produces smaller keys and signatures with strong security. P-256 is a good default for TLS server certificates. P-384 is suitable for higher-security CA certificates. P-521 is available when a larger security margin is required.

You do not need to generate a key manually before creating a certificate. The application generates a fresh key automatically during certificate creation.

Step 2: Enter Certificate Attributes

Fill in the subject fields:

At least one identity field such as CN, SAN, or email must be provided.

Step 3: Set Validity

Enter the number of days the certificate should be valid. The application checks that the validity is at least one day and does not exceed the supported maximum.

Typical values:

The application prevents creating a certificate where Valid Till would be before Valid From.

Step 4: Configure Basic Constraints

Leave This is a CA certificate unchecked for normal end-entity certificates.

Check it when creating a root CA or intermediate CA. The application automatically ensures CA certificates include the key usages required for certificate signing.

Path Length controls whether this CA may issue further CA certificates:

Step 5: Configure Key Usage

Common combinations:

The application applies conservative defaults where appropriate, but you should still select usages according to the purpose of the certificate.

Step 6: Configure Extended Key Usage

Extended Key Usage refines the certificate purpose:

Step 7: Configure Subject Alternative Names

For TLS certificates, Subject Alternative Names are required. Enter values as lists separated by commas, semicolons, spaces, or line breaks. Each field is normalized to a comma-separated list before generation, and each entry is validated for its SAN type:

You may paste OpenSSL-style entries such as DNS:example.com, DNS:www.example.com or IP Address:192.168.1.10; the prefixes are stripped in the UI and added again correctly when the certificate or CSR is built.

Invalid entries are rejected before a certificate or CSR is generated. For example, a DNS value containing characters outside the supported DNS name syntax is not accepted.

Modern TLS clients normally ignore the Common Name for host matching and require DNS or IP SAN entries.

Step 8: Choose Signing Mode

Select Self-Signed to create a certificate signed by its own private key. Use this for root CA certificates or simple test certificates.

Select Signed by CA to create a certificate signed by an existing CA. The CA certificate and CA private key must be stored in the configured Certificate Store folder.

When selecting CA files:

If the CA private key file is a combined PEM bundle containing both the CA certificate and the CA private key, the application uses the embedded certificate automatically and disables the separate CA certificate field.

Step 9: Set Output Options

On the Output tab, choose the generated file names.

Certificate file:

Private-key file:

PKCS#12/PFX:

CSR:

Step 10: Generate

Click Generate Certificate.

The application will:

  1. Generate a fresh key pair using the currently selected RSA/ECC settings.
  2. Normalize and validate SAN entries.
  3. Build the certificate subject, validity, and extensions.
  4. Sign the certificate as self-signed or with the selected CA.
  5. Save the selected output files into the Certificate Store.
  6. Refresh the Certificate Store list.
  7. Release the generated private key from the builder object after export.

Generate a CSR Instead

Click Generate CSR when you want to create a certificate signing request instead of an issued certificate.

The application will:

  1. Generate a fresh key pair using the currently selected RSA/ECC settings.
  2. Normalize and validate SAN entries.
  3. Build a CSR from the subject fields on the Certificate tab.
  4. Save the private key to the configured key file name.
  5. Save the CSR to the configured CSR file name.
  6. Refresh the Certificate Store list.
  7. Release the generated private key from the builder object after export.

The CSR contains the subject and public key. CertCreator-generated CSRs also include requested extensions for SAN, Basic Constraints, Key Usage, and Extended Key Usage from the Certificate tab. The CSR does not contain the private key or validity period. The signing CA still decides which requested extensions are accepted into the final certificate.

4. Certificate Store

The Certificate Store is a managed directory for generated and reusable certificate files. The configured path is saved in:

HKEY_CURRENT_USER\Software\ClassifyIt\CertCreator

Default location:

Certificates folder next to the application executable.

Changing the Store Directory

Use Browse to select a different directory. The full folder path is shown in the store path edit box. The choice is saved and restored the next time the application starts.

The Certificate Store is also used as a safety boundary for signing. CA certificate and CA private-key file names are resolved inside this folder.

Inspecting Files

Select a file in the store list to show:

Use Show PEM to display the PEM text of a selected text PEM file. PFX/P12 files are binary bundles and are not shown as PEM.

Use Test Key on a selected .key file to verify that it can be opened. If the key is encrypted, the application prompts for the password and reports whether it is correct.

Use Load Attrs on a selected .csr, .crt, .cer, or PEM certificate file to copy the subject fields, SAN values, CA flag, Key Usage, and Extended Key Usage into the Certificate tab. The imported SAN fields are normalized immediately. Loading attributes does not change the output file names on the Output tab.

Use Sign CSR on a selected .csr file to issue a certificate. Before signing, the application shows a confirmation explaining that the CSR provides the subject, public key, and may include requested extensions. The issued certificate uses the current Certificate tab settings for validity, CA flag, Key Usage, Extended Key Usage, and SAN values.

If the CA certificate or CA private key is not already selected, the application prompts you to select them from the Certificate Store. If the CA key is encrypted, the password is requested and tested immediately.

The generated certificate is saved to the certificate output file name on the Output tab.

If the output certificate file already exists, the application asks before overwriting it.

Opening and Deleting Files

Double-click a file to open it in the default Windows application.

Use Delete to remove the selected file. This permanently deletes the file after confirmation.

5. Common Workflows

Create a Self-Signed Root CA

  1. On the Certificate tab, select ECC P-384 or RSA 4096.
  2. Enter a CA subject, for example CN My Root CA, plus organization and country.
  3. Set validity, for example 3650 days.
  4. Check This is a CA certificate.
  5. Set Path Length to -1 for no explicit limit, or a smaller value according to your policy.
  6. Ensure Key Cert Sign and CRL Sign are selected.
  7. Select Self-Signed.
  8. On the Output tab, set names such as root_ca.crt and root_ca.key.
  9. Enter a strong private-key password.
  10. Click Generate Certificate.

Create an Intermediate CA

  1. Select ECC P-384 or RSA 4096.
  2. Enter the intermediate CA subject.
  3. Check This is a CA certificate.
  4. Set Path Length to 0 if this intermediate should not issue further sub-CAs.
  5. Select Signed by CA.
  6. Select the root CA private-key bundle. If it contains the root CA certificate, the CA certificate field is filled automatically.
  7. Enter the root CA key password if required.
  8. Set output names such as intermediate_ca.crt and intermediate_ca.key.
  9. Click Generate Certificate.

Create a TLS Server Certificate Signed by Your CA

  1. Select ECC P-256 or RSA 2048/3072.
  2. Enter CN as the server host name, for example api.example.com.
  3. Add DNS SAN api.example.com.
  4. Set validity, for example 365 days.
  5. Leave This is a CA certificate unchecked.
  6. Select Key Usage: Digital Signature and Key Encipherment.
  7. Select Extended Key Usage: TLS Server Authentication.
  8. Select Signed by CA.
  9. Choose the CA private-key bundle or select the CA certificate and CA key separately.
  10. Enter the CA key password if required.
  11. Set output names such as api.example.com.crt, api.example.com.key, and optionally api.example.com.pfx.
  12. Click Generate Certificate.

Create an S/MIME Email Certificate

  1. Select ECC P-256 or RSA 2048/3072.
  2. Enter the user's email address.
  3. Add the same address under SAN Emails.
  4. Select Extended Key Usage: Email Protection.
  5. Select a CA for signing or choose Self-Signed for testing.
  6. Set output names and generate the certificate.

Create a Certificate Signing Request

  1. On the Certificate tab, select the key type and parameters, for example ECC P-256 or RSA 2048.
  2. Enter the subject fields, for example CN, organization, country, and email.
  3. Fill SAN, Key Usage, Extended Key Usage, and CA settings if they should be requested in the CSR.
  4. On the Output tab, set the private-key file name, for example server.key.
  5. Set the CSR file name, for example server.csr.
  6. Enter a private-key password if the key should be encrypted.
  7. Click Generate CSR.

The application normalizes and validates SAN entries, creates a fresh key pair, saves the private key to the .key file, and saves the certificate signing request to the .csr file. The CSR contains the subject and public key, plus requested extensions for SAN, Basic Constraints, Key Usage, and Extended Key Usage. It does not contain the private key or validity period.

Sign a CSR to Create a CRT

  1. On the Certificate tab, set the certificate attributes that the CA should apply: validity, CA flag, path length, Key Usage, Extended Key Usage, and SAN values.
  2. Select Signed by CA.
  3. Select the CA private key. If the key contains the CA certificate, the CA certificate field is filled automatically.
  4. If needed, select the CA certificate separately.
  5. Enter the CA key password when prompted.
  6. On the Output tab, set the certificate output file name, for example server.crt.
  7. Open the Certificate Store tab.
  8. Select the .csr file.
  9. Review the CSR details and the effective signing settings shown in the memo.
  10. Optionally click Load Attrs first to copy the CSR subject and requested extensions into the Certificate tab.
  11. Click Sign CSR.
  12. Confirm that the current Certificate tab settings should be used.

The application normalizes and validates the current SAN fields, verifies the CSR signature, checks the CA certificate and private key, signs the CSR, and writes the issued certificate to the .crt output file. It does not create a .key or .pfx from a CSR because the CSR does not contain the requester's private key.

6. Security Notes

7. Extension Quick Reference

Key Usage

Extended Key Usage

8. Troubleshooting

The application does not start

Check that the required OpenSSL 3.x DLLs, libcrypto-3-x64.dll and libssl-3-x64.dll, are present in the application folder or on the system PATH.

The CA certificate field is disabled

The selected CA private-key file contains an embedded CA certificate. The application can use that certificate directly.

The selected certificate is rejected as CA

The certificate does not contain CA basic constraints or is not accepted by OpenSSL as a CA certificate. Select a real CA certificate.

The CA key does not match the CA certificate

Select the private key that belongs to the selected CA certificate. A CA certificate and private key must be a matching pair.

A TLS certificate is rejected by a browser or client

Check that the certificate has a DNS or IP Subject Alternative Name matching the server name. The Common Name alone is usually not enough.

SAN input is rejected

Check the DNS, IP, and email SAN fields for malformed values. The fields accept comma, semicolon, space, tab, and line-break separators, but every resulting entry must be valid for that SAN type.

A file does not show certificate attributes

The file may be encrypted, binary, malformed, or may not contain a certificate block. Use Show PEM for text PEM files or inspect PFX/P12 bundles with external certificate tools.