Encryption Certificate

Generate a 2048-bit RSA private key, a certificate signing request, and a base64 X.509 certificate for NHCX.

NHCX participants use an X.509 RSA certificate for encryption. Generate a private key and a public certificate before participant update.

Protect the private key

Never share private.key with NHCX or another participant. Share only the public certificate value.

Generate the certificate

Run OpenSSL to create a 2048-bit RSA private key.

Generate a 2048-bit RSA private key

openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048

OpenSSL writes the private key to private.key.

Create a certificate signing request from the private key.

Create a certificate signing request

openssl req -new -key private.key -out request.csr

Enter the country, state, organization, and email values when OpenSSL prompts you.

OpenSSL writes the request to request.csr.

Create a self-signed X.509 certificate from the request.

Generate a self-signed X.509 certificate

openssl x509 -req -in request.csr -signkey private.key -out certificate.crt -days 365

OpenSSL writes the public certificate to certificate.crt.

Encode the public certificate as base64.

Encode the certificate on macOS

base64 -i certificate.crt -o certificate.crt.b64

Encode the certificate on Linux

base64 -w 0 certificate.crt > certificate.crt.b64

Use the value in certificate.crt.b64 as the NHCX encryption certificate.

File	Purpose	Share with NHCX
`private.key`	RSA private key	No
`request.csr`	Certificate request	No
`certificate.crt`	Public X.509 certificate	Yes, after base64 encode
`certificate.crt.b64`	Base64 public certificate value	Yes

The certificate file uses PEM text. It starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.

Submit the base64 value during Production Onboarding.

Sources