How to acquire and verify a x509 Application Certificate

        openssl genrsa 2048 > appname-key.pem

    where appname matches the name the final certificate will apply to (e.g. if the application certificate CN is going to be foo.app.mit.edu, then this file would be foo-key.pem).

    appname-key.pem is the certificate's private key. Do not loose this key. Store it in a safe and secure location.

To generate a request for an application certificate, execute to following command line:

    openssl req -key appname-key.pem -new > appname-req.pem

where appname is as in a. above.

When prompted for input, use these answers: (or use the default answers for all but Common name and challenge password)

Country Name (2 letter code): US
State or Province Name (full name): Massachusetts
Locality Name (eg, city): Cambridge
Organization Name (eg, company): Massachusetts Institute of Technology
Organizational Unit Name (eg, section): (e.g. Information Services & Technology)
Common Name (eg, YOUR name): appname.app.mit.edu (i.e. name of the application certificate)
Email Address: enter a valid email address.
A challenge password: (anything you choose – keep a record)
An optional company name: (no entry required)

The file, appname-req.pem, contains the information for your certificate. Cut and paste the contents of this file into an email and sent it to mitcert@mit.edu. When you paste the contents of the req.pem file into the email, be sure to include the BEGIN and END lines.

The Subject line of the email should read: Request for an Application Certificate.

Also include in the body of the email, a short line stating that you are requesting an Application Certificate. Stating that you want an Application Certificate is important.

After a few days, you will receive an email that has your Application Certificate as an attachment. Save the Application Certificate to the directory you created in 1a above. You can change the name of the certificate file to something that is meaningful to you. In this document, the Application Certificate was assumed to be saved as appname.cer, where appname is as in section 1 above.

appname.cer is the actual application certificate. Do not loose this certificate. Store the certificate (along with it's private key generated in 1. above) in a safe and secure location.

View the Application Certificate to verify that you have the correct certificate. To view the certificate, execute the following command line:

    openssl x509 -in appname*.cer -text

Find the line that says: Netscape Cert Type. The line immediately following this line should say: SSL Client, SSL Server, S/MIME, Object Signing. If this is not the case, then you have the wrong type of certificate.

Also verify that the issuer of the certificate is the MIT client certificate authority by finding the following line (either of these is fine):

Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=Client CA V1

Issuer: C=US, O=Internet2, OU=InCommon, CN=InCommon Server CA

Also verify that the certificate is for your machine by finding your application certificate name in the certificate's Subject: line. It will be the CN entry and will be of the form appname.app.mit.edu

Finally verify the certificate's activation and expiration dates by looking at the two lines following Validity.