|
1
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
|
2
|
<html lang="en"><head><title>Debian Administration :: Creating and Using a self signed SSL Certificates in debian</title></head>
|
|
3
|
|
|
4
|
<body>
|
|
5
|
|
|
6
|
<h1>Creating and Using a self signed SSL Certificates in debian</h1>
|
|
7
|
<p align="right">Posted by <a href="http://debian-administration.org/users/Marcus_Redivo">Marcus_Redivo</a> on Thu 3 Nov 2005 at 12:30</p>
|
|
8
|
|
|
9
|
<p>This document covers a very specific, limited purpose, but one that
|
|
10
|
meets a common need: preventing browser, mail, and other clients from
|
|
11
|
complaining about the certificates installed on your server. Not
|
|
12
|
covered is dealing with a commercial root certificate authority (CA).
|
|
13
|
Instead, we will become our own root CA, and sign our own certificates.</p>
|
|
14
|
<p>(These procedures were developed using OpenSSL 0.9.6.)</p>
|
|
15
|
<b>Quick Start</b>
|
|
16
|
<p>Those who want to start creating certificates right away without
|
|
17
|
reading this whole document should skip to the summary at the end.</p>
|
|
18
|
<p>Note: a self-signed cert can be created with the simple command mod-ssl-makecert, part of the Debian package <a href="http://packages.debian.org/libapache-mod-ssl">libapache-mod-ssl</a>. </p>
|
|
19
|
|
|
20
|
|
|
21
|
<b>Background</b>
|
|
22
|
<blockquote>
|
|
23
|
<p>Why be our own root CA? So that we can take advantage of SSL
|
|
24
|
encryption without spending unnecessary money on having our
|
|
25
|
certificates signed.</p>
|
|
26
|
<p>A drawback is that browsers will still complain about our site not
|
|
27
|
being trusted until our root certificate is imported. However, once
|
|
28
|
this is done, we are no different from the commercial root CAs.</p>
|
|
29
|
<p>Clients will only import our root certificate if they trust us. This
|
|
30
|
is where the commercial CAs come in: they purport to do extensive
|
|
31
|
research into the people and organizations for whom they sign
|
|
32
|
certificates. By importing (actually, by the browser vendors
|
|
33
|
incorporating) their trusted root certificates, we are saying that we
|
|
34
|
trust them when they guarantee that someone else is who they say they
|
|
35
|
are. We can trust additional root CAs (like ourselves) by importing
|
|
36
|
their CA certificates. </p>
|
|
37
|
<p><b>Note</b>: If you are in the business of running a commercial
|
|
38
|
secure site, obtaining a commercially signed certificate is the only
|
|
39
|
realistic choice.</p>
|
|
40
|
</blockquote>
|
|
41
|
|
|
42
|
<b>Prerequisites</b>
|
|
43
|
<blockquote>
|
|
44
|
<p>You will need an installed copy of OpenSSL for this, which is available from <a href="http://www.openssl.org/" rel="nofollow">http://www.openssl.org/</a> Chances are it is already installed on your machine. This document will not cover the installation procedure.
|
|
45
|
</p><pre>> apt-get install openssl
|
|
46
|
</pre>
|
|
47
|
</blockquote>
|
|
48
|
|
|
49
|
<b>Initial Setup</b>
|
|
50
|
<blockquote>
|
|
51
|
<p>First, we will create a directory where we can work. It does not
|
|
52
|
matter where this is; I am arbitrarily going to create it in my home
|
|
53
|
directory. </p>
|
|
54
|
|
|
55
|
<pre>mkdir CA
|
|
56
|
cd CA
|
|
57
|
mkdir newcerts private
|
|
58
|
</pre>
|
|
59
|
<p>The CA directory will contain: </p>
|
|
60
|
<ul>
|
|
61
|
<li>Our Certificate Authority (CA) certificate </li>
|
|
62
|
<li>The database of the certificates that we have signed </li>
|
|
63
|
<li>The keys, requests, and certificates we generate </li>
|
|
64
|
</ul>
|
|
65
|
<p>It will also be our working directory when creating or signing certificates. </p>
|
|
66
|
<p>The <tt>CA/newcerts</tt> directory will contain: </p>
|
|
67
|
<ul>
|
|
68
|
<li>A copy of each certificate we sign </li>
|
|
69
|
</ul>
|
|
70
|
<p>The <tt>CA/private</tt> directory will contain:</p>
|
|
71
|
<ul>
|
|
72
|
<li>Our CA private key </li>
|
|
73
|
</ul>
|
|
74
|
<p>This key is important - Do not lose this key. Without it, you will
|
|
75
|
not be able to sign or renew any certificates. Do not disclose this key
|
|
76
|
to anyone. If it is compromised, others will be able to impersonate you.</p>
|
|
77
|
<p>Our next step is to create a database for the certificates we will sign: </p>
|
|
78
|
<pre>echo '01' > serial
|
|
79
|
touch index.txt
|
|
80
|
</pre>
|
|
81
|
<p>Rather than use the configuration file that comes with OpenSSL, we
|
|
82
|
are going to create a minimal configuration of our own in this
|
|
83
|
directory. Start your editor (vi, pico, ...) and create a basic <tt>openssl.cnf</tt>: </p>
|
|
84
|
<pre>#
|
|
85
|
# OpenSSL configuration file.
|
|
86
|
#
|
|
87
|
|
|
88
|
# Establish working directory.
|
|
89
|
dir = .
|
|
90
|
</pre>
|
|
91
|
</blockquote>
|
|
92
|
|
|
93
|
|
|
94
|
<b>Creating a Root Certificate</b>
|
|
95
|
<blockquote>
|
|
96
|
<p>With OpenSSL, a large part of what goes into a certificate depends
|
|
97
|
on the contents of the configuration file, rather than the command
|
|
98
|
line. This is a good thing, because there is a lot to specify. </p>
|
|
99
|
<p>The configuration file is divided into sections, which are
|
|
100
|
selectively read and processed according to openssl command line
|
|
101
|
arguments. Sections can include one or more other sections by referring
|
|
102
|
to them, which helps to make the configuration file more modular. A
|
|
103
|
name in square brackets (e.g. " req ") starts each section. </p>
|
|
104
|
<p>We now need to add the section that controls how certificates are
|
|
105
|
created, and a section to define the type of certificate to create. </p>
|
|
106
|
<p>The first thing we need to specify is the <tt>Distinguished Name</tt>.
|
|
107
|
This is the text that identifies the owner of the certificate when it
|
|
108
|
is viewed. It is not directly referenced in the configuration file, but
|
|
109
|
is included into the section processed when certificate requests are
|
|
110
|
created. The command is "<tt>openssl req</tt>", so the section is titled <tt>req</tt>.</p>
|
|
111
|
<p>Add the following to <tt>openssl.cnf</tt>: </p>
|
|
112
|
<pre>
|
|
113
|
[ req ]
|
|
114
|
default_bits = 1024 # Size of keys
|
|
115
|
default_keyfile = key.pem # name of generated keys
|
|
116
|
default_md = md5 # message digest algorithm
|
|
117
|
string_mask = nombstr # permitted characters
|
|
118
|
distinguished_name = req_distinguished_name
|
|
119
|
|
|
120
|
[ req_distinguished_name ]
|
|
121
|
# Variable name Prompt string
|
|
122
|
#---------------------- ----------------------------------
|
|
123
|
0.organizationName = Organization Name (company)
|
|
124
|
organizationalUnitName = Organizational Unit Name (department, division)
|
|
125
|
emailAddress = Email Address
|
|
126
|
emailAddress_max = 40
|
|
127
|
localityName = Locality Name (city, district)
|
|
128
|
stateOrProvinceName = State or Province Name (full name)
|
|
129
|
countryName = Country Name (2 letter code)
|
|
130
|
countryName_min = 2
|
|
131
|
countryName_max = 2
|
|
132
|
commonName = Common Name (hostname, IP, or your name)
|
|
133
|
commonName_max = 64
|
|
134
|
|
|
135
|
# Default values for the above, for consistency and less typing.
|
|
136
|
# Variable name Value
|
|
137
|
#------------------------------ ------------------------------
|
|
138
|
0.organizationName_default = The Sample Company
|
|
139
|
localityName_default = Metropolis
|
|
140
|
stateOrProvinceName_default = New York
|
|
141
|
countryName_default = US
|
|
142
|
|
|
143
|
[ v3_ca ]
|
|
144
|
basicConstraints = CA:TRUE
|
|
145
|
subjectKeyIdentifier = hash
|
|
146
|
authorityKeyIdentifier = keyid:always,issuer:always
|
|
147
|
</pre>
|
|
148
|
|
|
149
|
<p>In order to protect ourselves from unauthorized use of our CA
|
|
150
|
certificate, it is passphrase protected. Each time you use the CA
|
|
151
|
certificate to sign a request, you will be prompted for the passphrase.
|
|
152
|
Now would be a good time to pick a secure passphrase and put it in a
|
|
153
|
safe place. </p>
|
|
154
|
<p>All the preparation is now in place for creating our self-signed
|
|
155
|
root certificate. For this, we want to override some of the defaults we
|
|
156
|
just put into the configuration, so we will specify our overrides on
|
|
157
|
the command line. </p>
|
|
158
|
<p>Our overrides to the "openssl req" command are: </p>
|
|
159
|
<p>Create a new self-signed certificate: "<tt>-new -x509</tt>".</p>
|
|
160
|
<p>Create a CA certificate: "<tt>-extensions v3_ca </tt>".</p>
|
|
161
|
<p>Make it valid for more than 30 days: -"<tt>days 3650 </tt>".</p>
|
|
162
|
<p>Write output to specific locations: "<tt>-keyout, -out </tt>".</p>
|
|
163
|
<p>Use our configuration file: "<tt>-config ./openssl.cnf </tt>".</p>
|
|
164
|
<p>(A note on the term of validity of root certificates: When a root
|
|
165
|
certificate expires, all of the certificates signed with it are no
|
|
166
|
longer valid. To correct this situation, a new root certificate must be
|
|
167
|
created and distributed. Also, all certificates signed with the expired
|
|
168
|
one must be revoked, and re-signed with the new one. As this can be a
|
|
169
|
lot of work, you want to make your root certificate valid for as long
|
|
170
|
as you think you will need it. In this example, we are making it valid
|
|
171
|
for ten years.) </p>
|
|
172
|
<p>Run the command as shown. In this case, the PEM pass phrase it asks for is a new one, which you must enter twice: </p>
|
|
173
|
<pre>
|
|
174
|
# openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem \
|
|
175
|
-out cacert.pem -days 3650 -config ./openssl.cnf
|
|
176
|
Using configuration from ./openssl.cnf
|
|
177
|
Generating a 1024 bit RSA private key
|
|
178
|
.......++++++
|
|
179
|
..........................++++++
|
|
180
|
writing new private key to 'private/cakey.pem'
|
|
181
|
Enter PEM pass phrase:demo
|
|
182
|
Verifying password - Enter PEM pass phrase:demo
|
|
183
|
-----
|
|
184
|
You are about to be asked to enter information that will be incorporated
|
|
185
|
into your certificate request.
|
|
186
|
What you are about to enter is what is called a Distinguished Name or a DN.
|
|
187
|
There are quite a few fields but you can leave some blank
|
|
188
|
For some fields there will be a default value,
|
|
189
|
If you enter '.', the field will be left blank.
|
|
190
|
-----
|
|
191
|
Organization Name (company) [The Sample Company]:
|
|
192
|
Organizational Unit Name (department, division) []:CA Division
|
|
193
|
Email Address []:ca@sample.com
|
|
194
|
Locality Name (city, district) [Metropolis]:
|
|
195
|
State or Province Name (full name) [New York]:
|
|
196
|
Country Name (2 letter code) [US]:
|
|
197
|
Common Name (hostname, IP, or your name) []:TSC Root CA
|
|
198
|
|
|
199
|
</pre>
|
|
200
|
<p>This process produces two files as output: </p>
|
|
201
|
<ul>
|
|
202
|
<li>A private key in <tt>private/cakey.pem </tt>.</li>
|
|
203
|
<li>A root CA certificate in <tt>cacert.pem</tt>.</li>
|
|
204
|
</ul>
|
|
205
|
<p><tt>cacert.pem</tt> is the file you want to distribute to your clients. </p>
|
|
206
|
<p>The private key (<tt>cakey.pem</tt>) looks like this: </p>
|
|
207
|
<pre>-----BEGIN RSA PRIVATE KEY-----
|
|
208
|
Proc-Type: 4,ENCRYPTED
|
|
209
|
DEK-Info: DES-EDE3-CBC,0947F49BB28FE5F4
|
|
210
|
|
|
211
|
jlQvt9WdR9Vpg3WQT5+C3HU17bUOwvhp/r0+viMcBUCRW85UqI2BJJKTi1IwQQ4c
|
|
212
|
tyTrhYJYOP+A6JXt5BzDzZy/B7tjEMDBosPiwH2m4MaP+6wTbi1qR1pFDL3fXYDr
|
|
213
|
ZsuN08dkbw9ML6LOX5Rl6bIBL3i5hnGiqm338Fl52gNstThv0C/OZhXT3B4qsJn8
|
|
214
|
qZb3mC6U2nRaP/NpZPcEx4lv2vH7OzHTu1TZ7t0asSpgpuH58dfHPw775kZDep2F
|
|
215
|
LXA3Oeavg0TLFHkaFBUx2xaeEG6Txpt9I74aAsw1T6UbTSjqgtsK0PHdjPNfPGlY
|
|
216
|
5U3Do1pnU9hfoem/4RAOe0cCovP/xf6YPBraSFPs4XFfnWwgEtL09ReFqO9T0aSp
|
|
217
|
5ajLyBOYOBKQ3PCSu1HQDw/OzphInhKxdYg81WBBEfELzSdMFQZgmfGrt5DyyWmq
|
|
218
|
TADwWtGVvO3pEhO1STmCaNqZQSpSwEGPGo5RFkyFvyvyozWX2SZg4g1o1X40qSg9
|
|
219
|
0FMHTEB5HQebEkKBoRQMCJN/uyKXTLjNB7ibtVbZmfjsi9oNd3NJNVQQH+o9I/rP
|
|
220
|
wtFsjs+t7SKrsFB2cxZQdDlFzD6EBA+5ytebGEI1lJHcOUEa6P+LTphlwh/o1QuN
|
|
221
|
IKX2YKHA4ePrBzdgZ+xZuSLn/Qtjg/eZv6i73VXoHk8EdxfOk5xkJ+DnsNmyx0vq
|
|
222
|
W53+O05j5xsxzDJfWr1lqBlFF/OkIYCPcyK1iLs4GOwe/V0udDNwr2Uw90tefr3q
|
|
223
|
X1OZ9Dix+U0u6xXTZTETJ5dF3hV6GF7hP3Tmj9/UQdBwBzr+D8YWzQ==
|
|
224
|
-----END RSA PRIVATE KEY-----
|
|
225
|
</pre>
|
|
226
|
<p>Of course, you don't want to show this to anyone! Needless to say, the one shown here is now useless as a private key. </p>
|
|
227
|
<p>The certificate (<tt>cacert.pem</tt>) looks like this: </p>
|
|
228
|
<pre>-----BEGIN CERTIFICATE-----
|
|
229
|
MIIDrTCCAxagAwIBAgIBADANBgkqhkiG9w0BAQQFADCBnDEbMBkGA1UEChMSVGhl
|
|
230
|
IFNhbXBsZSBDb21wYW55MRQwEgYDVQQLEwtDQSBEaXZpc2lvbjEcMBoGCSqGSIb3
|
|
231
|
DQEJARYNY2FAc2FtcGxlLmNvbTETMBEGA1UEBxMKTWV0cm9wb2xpczERMA8GA1UE
|
|
232
|
CBMITmV3IFlvcmsxCzAJBgNVBAYTAlVTMRQwEgYDVQQDEwtUU0MgUm9vdCBDQTAe
|
|
233
|
Fw0wMTEyMDgwNDI3MDVaFw0wMjEyMDgwNDI3MDVaMIGcMRswGQYDVQQKExJUaGUg
|
|
234
|
U2FtcGxlIENvbXBhbnkxFDASBgNVBAsTC0NBIERpdmlzaW9uMRwwGgYJKoZIhvcN
|
|
235
|
AQkBFg1jYUBzYW1wbGUuY29tMRMwEQYDVQQHEwpNZXRyb3BvbGlzMREwDwYDVQQI
|
|
236
|
EwhOZXcgWW9yazELMAkGA1UEBhMCVVMxFDASBgNVBAMTC1RTQyBSb290IENBMIGf
|
|
237
|
MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaiAwfKB6ZBtnTRTIo6ddomt0S9ec0
|
|
238
|
NcuvtJogt0s9dXpHowh98FCDjnLtCi8du6LDTZluhlOtTFARPlV/LVnpsbyMCXMs
|
|
239
|
G2qpdjJop+XIBdvoCz2HpGXjUmym8WLqt+coWwJqUSwiEba74JG93v7TU+Xcvc00
|
|
240
|
5MWnxmKZzD/R3QIDAQABo4H8MIH5MAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFG/v
|
|
241
|
yytrBtEquMX2dreysix/MlPMMIHJBgNVHSMEgcEwgb6AFG/vyytrBtEquMX2drey
|
|
242
|
six/MlPMoYGipIGfMIGcMRswGQYDVQQKExJUaGUgU2FtcGxlIENvbXBhbnkxFDAS
|
|
243
|
BgNVBAsTC0NBIERpdmlzaW9uMRwwGgYJKoZIhvcNAQkBFg1jYUBzYW1wbGUuY29t
|
|
244
|
MRMwEQYDVQQHEwpNZXRyb3BvbGlzMREwDwYDVQQIEwhOZXcgWW9yazELMAkGA1UE
|
|
245
|
BhMCVVMxFDASBgNVBAMTC1RTQyBSb290IENBggEAMA0GCSqGSIb3DQEBBAUAA4GB
|
|
246
|
ABclymJfsPOUazNQO8aIaxwVbXWS+8AFEkMMRx6O68ICAMubQBvs8Buz3ALXhqYe
|
|
247
|
FS5G13pW2ZnAlSdTkSTKkE5wGZ1RYSfyiEKXb+uOKhDN9LnajDzaMPkNDU2NDXDz
|
|
248
|
SqHk9ZiE1boQaMzjNLu+KabTLpmL9uXvFA/i+gdenFHv
|
|
249
|
-----END CERTIFICATE-----
|
|
250
|
</pre>
|
|
251
|
<p>We can query the contents of this certificate with openssl to learn to whom belongs, what it is valid for, etc.: </p>
|
|
252
|
<pre>openssl x509 -in cacert.pem -noout -text
|
|
253
|
openssl x509 -in cacert.pem -noout -dates
|
|
254
|
openssl x509 -in cacert.pem -noout -purpose
|
|
255
|
</pre>
|
|
256
|
</blockquote>
|
|
257
|
|
|
258
|
|
|
259
|
<b>Creating a Certificate Signing Request (CSR)</b>
|
|
260
|
<blockquote>
|
|
261
|
<p>Now that we have a root certificate, we can create any number of
|
|
262
|
certificates for installation into our SSL applications such as HTTPS,
|
|
263
|
SPOP, or SIMAP. The procedure involves creating a private key and
|
|
264
|
certificate request, and then signing the request to generate the
|
|
265
|
certificate. </p>
|
|
266
|
<p>Our configuration file needs some more definitions for creating non-CA certificates. Add the following at the end of the file: </p>
|
|
267
|
<pre>[ v3_req ]
|
|
268
|
basicConstraints = CA:FALSE
|
|
269
|
subjectKeyIdentifier = hash
|
|
270
|
</pre>
|
|
271
|
<p>To avoid having to repeatedly put this on the command line, insert
|
|
272
|
the following line to the req section after the distinguished_name line
|
|
273
|
as shown: </p>
|
|
274
|
<pre>distinguished_name = req_distinguished_name
|
|
275
|
req_extensions = v3_req
|
|
276
|
</pre>
|
|
277
|
<p>Now we are ready to create our first certificate request. In this
|
|
278
|
example, we are going to create a certificate for a secure POP server
|
|
279
|
at <tt>mail.sample.com</tt>. Everything looks the same as when we created the CA certificate, but three of the ensuing prompts get different responses. </p>
|
|
280
|
<pre>Organizational Unit: a reminder of what the certificate is for
|
|
281
|
Email Address: the postmaster
|
|
282
|
Common Name: the server hostname
|
|
283
|
</pre>
|
|
284
|
<p>The Common Name must be (or the IP address must resolve to) the
|
|
285
|
server name your clients use to contact your host. If this does not
|
|
286
|
match, every time they connect your clients will get a message asking
|
|
287
|
them if they want to use this server. In effect, the client software is
|
|
288
|
saying:</p>
|
|
289
|
<blockquote>
|
|
290
|
"Warning! You asked for mail.sample.com; the responding machine's
|
|
291
|
certificate is for smtp.sample.com. Are you sure you want to continue?"
|
|
292
|
</blockquote>
|
|
293
|
|
|
294
|
<pre>openssl req -new -nodes -out req.pem -config ./openssl.cnf
|
|
295
|
|
|
296
|
Organizational Unit Name (department, division) :Mail Server Email Address :postmaster@sample.com
|
|
297
|
Common Name (hostname, IP, or your name) :mail.sample.com
|
|
298
|
</pre>
|
|
299
|
<p>This process produces two files as output: </p>
|
|
300
|
<ul>
|
|
301
|
<li>A private key in <tt>key.pem</tt> </li>
|
|
302
|
<li>A certificate signing request in <tt>req.pem</tt> </li>
|
|
303
|
</ul>
|
|
304
|
<p>These files should be kept. When the certificate you are about to
|
|
305
|
create expires, the request can be used again to create a new
|
|
306
|
certificate with a new expiry date. The private key is of course
|
|
307
|
necessary for SSL encryption. When you save these files, meaningful
|
|
308
|
names will help; for example, <tt>mailserver.key.pem</tt> and <tt>mailserver.req.pem.</tt>.</p>
|
|
309
|
<p>The certificate signing request looks like this: </p>
|
|
310
|
<pre>-----BEGIN CERTIFICATE REQUEST-----
|
|
311
|
MIICJDCCAY0CAQAwgagxGzAZBgNVBAoTElRoZSBTYW1wbGUgQ29tcGFueTEUMBIG
|
|
312
|
A1UECxMLTWFpbCBTZXJ2ZXIxJDAiBgkqhkiG9w0BCQEWFXBvc3RtYXN0ZXJAc2Ft
|
|
313
|
cGxlLmNvbTETMBEGA1UEBxMKTWV0cm9wb2xpczERMA8GA1UECBMITmV3IFlvcmsx
|
|
314
|
CzAJBgNVBAYTAlVTMRgwFgYDVQQDEw9tYWlsLnNhbXBsZS5jb20wgZ8wDQYJKoZI
|
|
315
|
hvcNAQEBBQADgY0AMIGJAoGBAPJhc++WxcBaoDbJpzFbDg42NcOz/ELVFMU4FlPa
|
|
316
|
yUzUO+xXkdFRMPKo54d4Pf1w575Jhlu9lE+kJ8QN2st6JFySbc9QjPwVwl9D2+I3
|
|
317
|
SSf2kVTu+2Ur5izCPbVAfU0rPZxxK8ELoOkA1uwwjFz6EFuVvnHwlguonWKDtmYW
|
|
318
|
u7KTAgMBAAGgOzA5BgkqhkiG9w0BCQ4xLDAqMAkGA1UdEwQCMAAwHQYDVR0OBBYE
|
|
319
|
FLWaQsUVIQzWr58HtDinH1JfeCheMA0GCSqGSIb3DQEBBAUAA4GBAAbe0jrGEQ3i
|
|
320
|
tyVfy5Lg4/f69rKvDGs+uhZJ9ZRx7Dl92Qq2osE7XrLB1bANmcoEv/ORLZOjWZEY
|
|
321
|
NjMvuz60O7R8GKBrvb/YhAwWhIIt2LJqPkpAEWS0kY0AkoQcfZ7h6oC35+eJ7okg
|
|
322
|
Uu3WuE57RgcNt7/ftr0sG1jUyRwMLvhv
|
|
323
|
-----END CERTIFICATE REQUEST-----
|
|
324
|
</pre>
|
|
325
|
<p>We can view the contents to make sure our request is correct: </p>
|
|
326
|
<pre>openssl req -in req.pem -text -verify -noout
|
|
327
|
</pre>
|
|
328
|
</blockquote>
|
|
329
|
|
|
330
|
|
|
331
|
<b>Signing a Certificate</b>
|
|
332
|
<blockquote>
|
|
333
|
<p>Now we need to add the configuration file section that deals with
|
|
334
|
being a Certificate Authority. This section will identify the paths to
|
|
335
|
the various pieces, such as the database, the CA certificate, and the
|
|
336
|
private key. It also provides some basic default values. Insert the
|
|
337
|
following into <tt>openssl.cnf</tt> just before the req section: </p>
|
|
338
|
<pre>[ ca ]
|
|
339
|
default_ca = CA_default
|
|
340
|
|
|
341
|
[ CA_default ]
|
|
342
|
serial = $dir/serial
|
|
343
|
database = $dir/index.txt
|
|
344
|
new_certs_dir = $dir/newcerts
|
|
345
|
certificate = $dir/cacert.pem
|
|
346
|
private_key = $dir/private/cakey.pem
|
|
347
|
default_days = 365
|
|
348
|
default_md = md5
|
|
349
|
preserve = no
|
|
350
|
email_in_dn = no
|
|
351
|
nameopt = default_ca
|
|
352
|
certopt = default_ca
|
|
353
|
policy = policy_match
|
|
354
|
|
|
355
|
[ policy_match ]
|
|
356
|
countryName = match
|
|
357
|
stateOrProvinceName = match
|
|
358
|
organizationName = match
|
|
359
|
organizationalUnitName = optional
|
|
360
|
commonName = supplied
|
|
361
|
emailAddress = optional
|
|
362
|
</pre>
|
|
363
|
<p>To sign the request we made in the previous step, execute the
|
|
364
|
following and respond to the prompts. Note that you are asked for the
|
|
365
|
PEM passphrase selected earlier: </p>
|
|
366
|
<pre>openssl ca -out cert.pem -config ./openssl.cnf -infiles req.pem
|
|
367
|
Using configuration from ./openssl.cnf
|
|
368
|
Enter PEM pass phrase:demo
|
|
369
|
Check that the request matches the signature
|
|
370
|
Signature ok
|
|
371
|
The Subjects Distinguished Name is as follows
|
|
372
|
organizationName :PRINTABLE:'The Sample Company'
|
|
373
|
organizationalUnitName:PRINTABLE:'Mail Server'
|
|
374
|
emailAddress :IA5STRING:'postmaster@sample.com'
|
|
375
|
localityName :PRINTABLE:'Metropolis'
|
|
376
|
stateOrProvinceName :PRINTABLE:'New York'
|
|
377
|
countryName :PRINTABLE:'US'
|
|
378
|
commonName :PRINTABLE:'mail.sample.com'
|
|
379
|
Certificate is to be certified until Dec 8 04:37:38 2002 GMT (365 days)
|
|
380
|
Sign the certificate? [y/n]:y
|
|
381
|
|
|
382
|
1 out of 1 certificate requests certified, commit? [y/n]y
|
|
383
|
Write out database with 1 new entries
|
|
384
|
Data Base Updated
|
|
385
|
</pre>
|
|
386
|
<p>This process updates the CA database, and produces two files as output:</p>
|
|
387
|
<ul>
|
|
388
|
<li>A certificate in <tt>cert.pem</tt></li>
|
|
389
|
<li>A copy of the certificate in <tt>newcerts/.pem </tt></li>
|
|
390
|
</ul>
|
|
391
|
<p>Again, you can inspect the certificate: </p>
|
|
392
|
<pre>openssl x509 -in cert.pem -noout -text -purpose | more
|
|
393
|
</pre>
|
|
394
|
<p>The certificate has both the encoded version and a human-readable
|
|
395
|
version in the same file. You can strip off the human-readable portion
|
|
396
|
as follows: </p>
|
|
397
|
<pre>mv cert.pem tmp.pem
|
|
398
|
openssl x509 -in tmp.pem -out cert.pem
|
|
399
|
</pre>
|
|
400
|
</blockquote>
|
|
401
|
|
|
402
|
|
|
403
|
<b>Installing the Certificate and Key</b>
|
|
404
|
<blockquote>
|
|
405
|
<p>This depends on the application. Some want the key and the
|
|
406
|
certificate in the same file, and others want them separately.
|
|
407
|
Combining them is easily done with: </p>
|
|
408
|
<pre>cat key.pem cert.pem >key-cert.pem
|
|
409
|
</pre>
|
|
410
|
<p>After this step, you have three installable components to choose from: </p>
|
|
411
|
<ul>
|
|
412
|
<li>A private key in <tt>key.pem</tt>.</li>
|
|
413
|
<li>A certificate in <tt>cert.pem</tt>.</li>
|
|
414
|
<li>A combined private key and certificate in <tt>key-cert.pem </tt>.</li>
|
|
415
|
<p>Copy the appropriate files into the locations specified by the
|
|
416
|
instructions for your application and system. Restart the applications,
|
|
417
|
and you are in operation with your new certificate. </p>
|
|
418
|
|
|
419
|
<b>Apache </b>
|
|
420
|
<blockquote>
|
|
421
|
<p>Apache has separate configuration directives for the key and the
|
|
422
|
certificate, so we keep each in its own file. These files should be
|
|
423
|
kept outside of the DocumentRoot subtree, so a reasonable directory
|
|
424
|
structure might be: </p>
|
|
425
|
<pre>File Comment
|
|
426
|
/home/httpd/html Apache DocumentRoot
|
|
427
|
/home/httpd/ssl SSL-related files
|
|
428
|
/home/httpd/ssl/cert.pem Site certificate
|
|
429
|
/home/httpd/ssl/key.pem Site private key
|
|
430
|
</pre>
|
|
431
|
<p>Within the directive for the site (which of course should be on port 443), include the directives that point to these files: </p>
|
|
432
|
<pre> ServerName mail.sample.com
|
|
433
|
DocumentRoot /home/httpd/html
|
|
434
|
... other directives for this site ...
|
|
435
|
SSLEngine on
|
|
436
|
SSLLog /var/log/ssl_engine_log
|
|
437
|
SSLCertificateFile /home/httpd/ssl/cert.pem
|
|
438
|
SSLCertificateKeyFile /home/httpd/ssl/key.pem
|
|
439
|
</pre>
|
|
440
|
</blockquote>
|
|
441
|
|
|
442
|
<b>Stunnel </b>
|
|
443
|
<blockquote>
|
|
444
|
<p><tt>stunnel</tt> is used as an SSL wrapper for normal non-secure
|
|
445
|
services such as IMAP and POP. It accepts as arguments (among other
|
|
446
|
things) the service to execute, and the location of the certificate and
|
|
447
|
private key.</p>
|
|
448
|
<p>The key and the certificate are provided in the same file. These can go anywhere, but a good location might be <tt>/etc/ssl/certs</tt>. Specify it on the stunnel command line as follows:
|
|
449
|
</p><pre>stunnel -p /etc/ssl/certs/key-cert.pem
|
|
450
|
</pre>
|
|
451
|
</blockquote>
|
|
452
|
</ul></blockquote>
|
|
453
|
|
|
454
|
<b>Distributing the CA Certificate</b>
|
|
455
|
<blockquote>
|
|
456
|
<p>This, finally, is the step that stops the clients from complaining about untrusted certificates. Send <tt>cacert.pem</tt>
|
|
457
|
to anyone who is going to use your secure servers, so they can install
|
|
458
|
it in their browsers, mail clients, et cetera as a root certificate. </p>
|
|
459
|
</blockquote>
|
|
460
|
|
|
461
|
<b>Renewing Certificates</b>
|
|
462
|
<blockquote>
|
|
463
|
<p>Your certificate chain can break due to certificate expiry in two ways: </p>
|
|
464
|
<ul>
|
|
465
|
<li>The certificates you signed with your root certificate have expired. </li>
|
|
466
|
<li>Your root certificate itself has expired. </li>
|
|
467
|
</ul>
|
|
468
|
<p>In the second case, you have some work to do. A new root CA
|
|
469
|
certificate must be created and distributed, and then your existing
|
|
470
|
certificates must be recreated or re-signed. </p>
|
|
471
|
<p>In the first case, you have two options. You can either generate new
|
|
472
|
certificate signing requests and sign them as described above, or (if
|
|
473
|
you kept them) you can re-sign the original requests. In either case,
|
|
474
|
the old certificates must be revoked, and then the new certificates
|
|
475
|
signed and installed into your secure applications as described
|
|
476
|
earlier. </p>
|
|
477
|
<p>You cannot issue two certificates with the same Common Name, which
|
|
478
|
is why the expired certificates must be revoked. The certificate is in
|
|
479
|
the newcerts directory; you can determine its filename by browsing <tt>index.txt</tt>
|
|
480
|
and searching for the Common Name (CN) on it. The filename is the index
|
|
481
|
plus the extension ".pem", for example "02.pem". To revoke a
|
|
482
|
certificate: </p>
|
|
483
|
<pre>openssl ca -revoke newcerts/02.pem -config ./openssl.cnf
|
|
484
|
Using configuration from ./openssl.cnf
|
|
485
|
Enter PEM pass phrase: demo
|
|
486
|
Revoking Certificate 02.
|
|
487
|
Data Base Updated
|
|
488
|
</pre>
|
|
489
|
<p>Now that the certificate has been revoked, you can re-sign the
|
|
490
|
original request, or create and sign a new one as described above. </p>
|
|
491
|
</blockquote>
|
|
492
|
|
|
493
|
<b>Getting a Commercially Signed Certificate</b>
|
|
494
|
<blockquote>
|
|
495
|
<p>The process is basically the same as the one just demonstrated, but
|
|
496
|
the CA does most of it. You need to generate a Certificate Signing
|
|
497
|
Request as shown above, and then submit it for signing. You will
|
|
498
|
receive a signed certificate for installation. </p>
|
|
499
|
<p>This certificate will automatically be trusted by your client's
|
|
500
|
browser, as the browser has the commercial CA's certificate built in.
|
|
501
|
There is no need to distribute anything. </p>
|
|
502
|
<p>The configuration described here may be inadequate for this purpose,
|
|
503
|
as there is much more that can go into a request. Different certificate
|
|
504
|
authorities require different features in the certificate signing
|
|
505
|
request, none of which we have gone into here. This additional material
|
|
506
|
is beyond the current scope of this document. </p>
|
|
507
|
</blockquote>
|
|
508
|
|
|
509
|
<b>Publishing Your CA Certificate</b>
|
|
510
|
<blockquote>
|
|
511
|
<p>You can post the certificate on your web site for download. If you
|
|
512
|
do this, you should also post a Certificate Revocation List (CRL), and
|
|
513
|
a means of displaying a certificate given its serial number. This is
|
|
514
|
outside the current scope of this document. </p>
|
|
515
|
<p>Apache will serve your certificate in a form recognizable to
|
|
516
|
browsers if you specify its MIME type. For example, you can use the
|
|
517
|
filename extension ".crt" for downloadable certificates, and put the
|
|
518
|
following into the general section of your Apache configuration: </p>
|
|
519
|
<pre>AddType application/x-x509-ca-cert .crt
|
|
520
|
</pre>
|
|
521
|
<p>Now you can post the certificate for download with a link like
|
|
522
|
<a href="http://www.example.com/ourrootcert.crt" rel="nofollow">Our Root Certificate</a> </p>
|
|
523
|
<p>and when the link is followed the visitor's browser would offer to install the certificate. </p>
|
|
524
|
<p>The CRL can be created as follows: </p>
|
|
525
|
<pre>openssl ca -gencrl -crldays 31 -config ./openssl.cnf -out rootca.crl
|
|
526
|
</pre>
|
|
527
|
</blockquote>
|
|
528
|
|
|
529
|
<b>Summary</b>
|
|
530
|
<blockquote>
|
|
531
|
<p>You now have enough information to create and sign certificates on
|
|
532
|
your own behalf. While this is a fairly long document, the procedure
|
|
533
|
can be summarized easily. </p>
|
|
534
|
|
|
535
|
|
|
536
|
<b>One-Time Setup</b>
|
|
537
|
<p>Set up, and create a root CA certificate. Commands:</p>
|
|
538
|
<pre># mkdir CA
|
|
539
|
# cd CA
|
|
540
|
# mkdir newcerts private
|
|
541
|
# echo '01' >serial
|
|
542
|
# touch index.txt
|
|
543
|
# (IMPORTANT: Install and edit the configuration file shown below.)
|
|
544
|
# openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem \
|
|
545
|
-out cacert.pem -days 365 -config ./openssl.cnf
|
|
546
|
</pre>
|
|
547
|
<p>Output :</p>
|
|
548
|
<ul>
|
|
549
|
<li><tt>cacert.pem</tt> - CA certificate </li>
|
|
550
|
<li><tt>private/cakey.pem</tt> - CA private key </li>
|
|
551
|
</ul>
|
|
552
|
<p>Distribute cacert.pem to your clients. </p>
|
|
553
|
|
|
554
|
<b>Per Certificate</b>
|
|
555
|
<p>Create certificate signing requests and sign them, supplying
|
|
556
|
appropriate values for the Common Name and the Organizational Unit. </p>
|
|
557
|
<p>Commands :</p>
|
|
558
|
<pre>openssl req -new -nodes -out req.pem -config ./openssl.cnf
|
|
559
|
openssl ca -out cert.pem -config ./openssl.cnf -infiles req.pem
|
|
560
|
cat key.pem cert.pem >key-cert.pem
|
|
561
|
</pre>
|
|
562
|
<p>Output :</p>
|
|
563
|
<ul>
|
|
564
|
<li><tt>key.pem</tt> - Private key </li>
|
|
565
|
<li><tt>req.pem</tt> - Certificate signing request </li>
|
|
566
|
<li><tt>cert.pem</tt> - Certificate </li>
|
|
567
|
<li><tt>key-cert.pem</tt> - Combined private key and certificate </li>
|
|
568
|
</ul>
|
|
569
|
<p>Install <tt>key.pem</tt> and <tt>cert.pem</tt>, or just <tt>key-cert.pem</tt> as appropriate for your server application.</p>
|
|
570
|
<b>Per Certificate - Renewal</b>
|
|
571
|
<p>Revoke the expired certificate, and re-sign the original request.
|
|
572
|
</p><p>Commands :</p>
|
|
573
|
<pre>openssl ca -revoke newcerts/.pem -config ./openssl.cnf
|
|
574
|
openssl ca -out cert.pem -config ./openssl.cnf -infiles req.pem
|
|
575
|
</pre>
|
|
576
|
<p>Install the renewed certificates in the same manner as the original ones. </p>
|
|
577
|
<p>Configuration File </p>
|
|
578
|
<pre>#
|
|
579
|
# OpenSSL configuration file.
|
|
580
|
#
|
|
581
|
|
|
582
|
# Establish working directory.
|
|
583
|
|
|
584
|
dir = .
|
|
585
|
|
|
586
|
[ ca ]
|
|
587
|
default_ca = CA_default
|
|
588
|
|
|
589
|
[ CA_default ]
|
|
590
|
serial = $dir/serial
|
|
591
|
database = $dir/index.txt
|
|
592
|
new_certs_dir = $dir/newcerts
|
|
593
|
certificate = $dir/cacert.pem
|
|
594
|
private_key = $dir/private/cakey.pem
|
|
595
|
default_days = 365
|
|
596
|
default_md = md5
|
|
597
|
preserve = no
|
|
598
|
email_in_dn = no
|
|
599
|
nameopt = default_ca
|
|
600
|
certopt = default_ca
|
|
601
|
policy = policy_match
|
|
602
|
|
|
603
|
[ policy_match ]
|
|
604
|
countryName = match
|
|
605
|
stateOrProvinceName = match
|
|
606
|
organizationName = match
|
|
607
|
organizationalUnitName = optional
|
|
608
|
commonName = supplied
|
|
609
|
emailAddress = optional
|
|
610
|
|
|
611
|
[ req ]
|
|
612
|
default_bits = 1024 # Size of keys
|
|
613
|
default_keyfile = key.pem # name of generated keys
|
|
614
|
default_md = md5 # message digest algorithm
|
|
615
|
string_mask = nombstr # permitted characters
|
|
616
|
distinguished_name = req_distinguished_name
|
|
617
|
req_extensions = v3_req
|
|
618
|
|
|
619
|
[ req_distinguished_name ]
|
|
620
|
# Variable name Prompt string
|
|
621
|
#---------------------- ----------------------------------
|
|
622
|
0.organizationName = Organization Name (company)
|
|
623
|
organizationalUnitName = Organizational Unit Name (department, division)
|
|
624
|
emailAddress = Email Address
|
|
625
|
emailAddress_max = 40
|
|
626
|
localityName = Locality Name (city, district)
|
|
627
|
stateOrProvinceName = State or Province Name (full name)
|
|
628
|
countryName = Country Name (2 letter code)
|
|
629
|
countryName_min = 2
|
|
630
|
countryName_max = 2
|
|
631
|
commonName = Common Name (hostname, IP, or your name)
|
|
632
|
commonName_max = 64
|
|
633
|
|
|
634
|
# Default values for the above, for consistency and less typing.
|
|
635
|
# Variable name Value
|
|
636
|
#------------------------------ ------------------------------
|
|
637
|
0.organizationName_default = The Sample Company
|
|
638
|
localityName_default = Metropolis
|
|
639
|
stateOrProvinceName_default = New York
|
|
640
|
countryName_default = US
|
|
641
|
|
|
642
|
[ v3_ca ]
|
|
643
|
basicConstraints = CA:TRUE
|
|
644
|
subjectKeyIdentifier = hash
|
|
645
|
authorityKeyIdentifier = keyid:always,issuer:always
|
|
646
|
|
|
647
|
[ v3_req ]
|
|
648
|
basicConstraints = CA:FALSE
|
|
649
|
subjectKeyIdentifier = hash
|
|
650
|
|
|
651
|
</pre>
|
|
652
|
</blockquote>
|
|
653
|
|
|
654
|
<h3>Updated: 9th November 2005</h3>
|
|
655
|
<blockquote>
|
|
656
|
<p>It has been brought to my attention that this article has been
|
|
657
|
plagiarized by the poster who claimed it as his own work. That poster
|
|
658
|
has now has his accoutn suspended.</p>
|
|
659
|
<p>The original author of the article, Marcus Redivo, has kindly
|
|
660
|
allowed the text to remain on this site. The original article as
|
|
661
|
written by Marcus can be found upon his website here:</p>
|
|
662
|
<ul>
|
|
663
|
<li><a href="http://www.eclectica.ca/howto/ssl-cert-howto.php">http://www.eclectica.ca/howto/ssl-cert-howto.php</a></li>
|
|
664
|
</ul>
|
|
665
|
</blockquote>
|
|
666
|
|
|
667
|
<hr>
|
|
668
|
<p>This article can be found online at the <b>Debian Administration </b> website at the following bookmarkable URL:</p>
|
|
669
|
<ul>
|
|
670
|
<li><a href="http://www.debian-administration.org/articles/284">http://www.debian-administration.org/articles/284</a></li>
|
|
671
|
</ul>
|
|
672
|
<p>At the time this print version was generated, the online version had 18 comments posted in reply to it.
|
|
673
|
</p>
|
|
674
|
<p>This article is copyrighted, please check the online version for details.</p>
|
|
675
|
|
|
676
|
|
|
677
|
</body></html>
|