HannibalWiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

The Openssl software offers all the features that are required to create ourselves some certificate requests and/or self-signed certificates.
Note that the Fedora Directory Server does NOT support openssl. It uses the Network Security Services (NSS) library available from the Mozilla Project (http://www.mozilla.org/projects/security/). So we'll use that for the Fedora Directory Server and openssl for all other applications. 

  
First install the software, allthough it might already be present on your system.
  apt-get install openssl

Configure /etc/ssl/openssl.cnf
<code>
 HOME                    = .
 RANDFILE                = $ENV::HOME/.rnd
 oid_section             = new_oids
 [ new_oids ]
 [ ca ]
 default_ca      = CA_default            # The default ca section
 [ CA_default ]
 dir             = ./hannibalCA          # Where everything is kept
 certs           = $dir/certs            # Where the issued certs are kept
 crl_dir         = $dir/crl              # Where the issued crl are kept
 database        = $dir/index.txt        # database index file.
 new_certs_dir   = $dir/newcerts         # default place for new certs.
 certificate     = $dir/cacert.pem       # The CA certificate
 serial          = $dir/serial           # The current serial number
 crl             = $dir/crl.pem          # The current CRL
 private_key     = $dir/private/cakey.pem# The private key
 RANDFILE        = $dir/private/.rand    # private random number file
 x509_extensions = usr_cert              # The extentions to add to the cert
 name_opt        = ca_default            # Subject Name options
 cert_opt        = ca_default            # Certificate field options
 default_days    = 730                   # how long to certify for
 default_crl_days= 30                    # how long before next CRL
 default_md      = md5                   # which md to use.
 preserve        = no                    # keep passed DN ordering
 policy       [ policy_match ]
 countryName             = match
 stateOrProvinceName     = match
 organizationName        = match 
 organizationalUnitName  = optional
 commonName              = supplied
 emailAddress            = optional
 [ req ]
 default_bits            = 1024
 default_keyfile         = privkey.pem
 distinguished_name      = req_distinguished_name
 attributes              = req_attributes
 x509_extensions = v3_ca # The extentions to add to the self signed cert
 string_mask = nombstr
 [ req_distinguished_name ]
 countryName                     = Country Name (2 letter code)
 countryName_default             = NL
 countryName_min                 = 2
 countryName_max                 = 2
 stateOrProvinceName             = State or Province Name (full name)
 stateOrProvinceName_default     = NH
 localityName                    = Locality Name (eg, city)
 localityName_default            = Amsterdam
 0.organizationName              = Organization Name (eg, company)
 0.organizatioorganizationalUnitName          = Organizational Unit Name (eg, section)
 organizationalUnitName_default  = NOC
 commonName                      = Common Name (eg, YOUR name)
 commonName_default              = CA
 commonName_max                  = 64
 emailAddress                    = Email Address
 emailAddress_default            = postmaster@intra.example.com
 emailAddress_max                = 64
 [ req_attributes ]
 challengePassword               = A challenge password
 challengePassword_min           = 4
 challengePassword_max           = 20
 unstructuredName                = An optional company name
 [ usr_cert ]
 basicConstraints=CA:FALSE
 nsComment                       = "OpenSSL Generated Certificate"
 subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid,issuer:always
 [ v3_req ]
 basicConstraints = CA:FALSE
 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 [ v3_ca ]
 subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid:always,issuer:always
 basicConstraints = CA:true
 [ crl_ext ]
 authorityKeyIdentifier=keyid:always,issuer:always
</code>

Create a Certificate Authority for your site:
   cd /usr/lib/ssl/misc


   ./CA.sh -newca

Or create the Certificate Authority by hand; something like
   mkdir /opt/exampleca
   cd /opt/exampleca
   mkdir certs private
   chmod 700 private
   echo '01' > serial
   touch index.txt

Remember to adjust openssl.cnf accordingly;

Then create your CA's private key and your CA's public cert
  openssl req -x509 -newkey rsa -out cacert.pem -outform PEM

Do a certificate request per necessary certificate. You can modify the CA.sh script in order to prevent having to enter passphrases per certificate (add the option -nodes)
  ./CA.sh -newreq

Or issue the openssl-command by hand:
  openssl req -newkey rsa:1024 -nodes -keyout newkey.pem -keyform PEM -nodes -out newreq.pem -outform PEM

Sign the newly created certificates
  ./CA.sh -sign

Or issue the openssl-command by hand:
  openssl ca -in newreq.pem

Remember to protect the newly generated keys
  chmod 600 *req*
HannibalWiki

User Tools

Site Tools

Page Tools
