title: OpenSSL Self-signed Root CA certificate: Set a start date
body: <p>I'm creating a little test CA with its own self-signed certificate using the following setup (using OpenSSL 1.0.1 14 Mar 2012). The issue I have is that if I look at the start date of the CAs own certificate, it creates it for tomorrow (and I'd like to use it today).</p>
  
  <pre><code>&gt; openssl x509 -noout -startdate -enddate -in ~/my_little_ca/cacert.pem 
  notBefore=Jan  2 16:05:52 2015 GMT
  notAfter=Feb  1 16:05:52 2015 GMT
  </code></pre>
  
  <p>So I dug around a little because I had the same problem with certificates I signed using the CA. For these certificates I can set the start date using the <code>--startdate</code>, but I cannot see a similar option for the CAs root certificate. I've tried using <code>default_startdate</code> in the openssl config file used when generating the CA, but that seems to be ignored for some reason?</p>
  
  <p>I create the CA as follows, which is basically just taken almost verbatim from "Network Security with OpenSSL" by Pravir Chandra et al, as shown further below.</p>
  
  <p><strong>The command used is <code>req -x509 -newkey rsa:2048 -out cacert.pem -outform PEM -verbose</code>, but what I'd like to know is how do I set the startdate in this particular case when generating the root CAs certificate and private key?</strong> Thank you in advance.</p>
  
  <p>The full script to generate the CA is below:</p>
  
  <pre><code>MYDIR=$(pwd -P)
  BASEDIR=~/enigma_ca
  
  
  mkdir -pv $BASEDIR
  cd $BASEDIR
  
  mkdir -pv private
  chmod g-rwx,o-rwx private
  mkdir -pv certs
  touch index.txt
  echo '01' &gt; serial
  
  DEFAULT_STARTDATE=$(date +'%y%m01000000Z')
  
  cat &lt;&lt;EOF &gt;openssl.cnf
  [ ca ]
  default_ca = my_test_ca
  
  [ my_test_ca ]
  certificate       = $BASEDIR/cacert.pem
  database          = $BASEDIR/index.txt
  new_certs_dir     = $BASEDIR/certs
  private_key       = $BASEDIR/private/cakey.pem
  serial            = $BASEDIR/serial
  
  default_crl_days  = 7
  default_days      = 356
  default_md        = md5
  default_startdate = $DEFAULT_STARTDATE
  
  policy            = my_test_ca_policy
  x509_extensions   = certificate_extensions
  
  [ my_test_ca_policy ]
  commonName              = supplied
  stateOrProvinceName     = supplied
  countryName             = supplied
  emailAddress            = supplied
  organizationName        = supplied
  organizationalUnitName  = optional
  
  [ certificate_extensions ]
  basicConstraints  = CA:false
  
  [ req ]
  default_bits      = 2048
  default_keyfile   = $BASEDIR/private/cakey.pem
  default_md        = md5
  default_startdate = $DEFAULT_STARTDATE
  default_days      = 356
  
  prompt              = no
  distinguished_name  = root_ca_distinguished_name
  x509_extensions     = root_ca_extensions
  
  [ root_ca_distinguished_name ]
  commonName           = My Mini CA
  stateOrProvinceName  = Hampshire
  countryName          = UK
  emailAddress         = ca@myminica.com
  organizationName     = My Mini CA Ltd
  
  [ root_ca_extensions ]
  basicConstraints = CA:true
  
  EOF
  
  
  OPENSSL_CONF=$BASEDIR/openssl.cnf
  export OPENSSL_CONF
  
  # Now generate self-signed certificate and generate key pair to go with it...
  expect - &lt;&lt;EOF &gt;&gt; $MYDIR/ca_debug.txt
  puts [concat "OPENSSL_CONF =" \$::env(OPENSSL_CONF)]
  spawn openssl req -x509 -newkey rsa:2048 -out cacert.pem -outform PEM -verbose
  expect "PEM pass phrase:"
  send "junk\r"
  expect "PEM pass phrase:"
  send "junk\r"
  expect eof
  EOF
  </code></pre>