Certificates » History » Version 1
Joseph Foley, 2015-09-05 03:05
| 1 | 1 | Joseph Foley | h1. Certificates |
|---|---|---|---|
| 2 | |||
| 3 | A bunch of services need a signed certificate. In the interest of making those warning messages at least different, we are setting up a simple CA. These file have been setup in root's homedirectory on @gryla.dev.ru.is@ This means that these are Ubuntu 12.04LTS specific directions. Paths will vary for other flavors of linux. |
||
| 4 | |||
| 5 | Jabber clients in particular hate self-signed certificates. |
||
| 6 | |||
| 7 | h2. References |
||
| 8 | |||
| 9 | * How to Setup a CA http://pages.cs.wisc.edu/~zmiller/ca-howto/ |
||
| 10 | |||
| 11 | |||
| 12 | h2. Generating the CA |
||
| 13 | |||
| 14 | Taken from the "How to Setup a CA" in the References. |
||
| 15 | |||
| 16 | h3. Setting up the defaults |
||
| 17 | |||
| 18 | * Adjust the standard defaults (Debian). |
||
| 19 | <pre>sudo su - |
||
| 20 | cd /etc/ssl |
||
| 21 | emacs /etc/ssl/openssl.cnf</pre> |
||
| 22 | * Change the section under "req_distinguished_name" |
||
| 23 | |||
| 24 | h3. Generate the keys and general setup |
||
| 25 | |||
| 26 | * Gen the key and set the passphrase. (hint: evil cat, no capitals) |
||
| 27 | <pre>cd /etc/ssl |
||
| 28 | openssl genrsa -des3 -out private/cakey.pem 1024</pre> |
||
| 29 | * Self sign the cert |
||
| 30 | <pre>openssl req -new -x509 -days 3650 -key private/cakey.pem -out cacert.pem </pre> |
||
| 31 | ** Common Name: ROOT CA |
||
| 32 | ** Email: *leave this blank!!* |
||
| 33 | * Examine the cert |
||
| 34 | <pre>openssl x509 -noout -text -in cacert.pem</pre> |
||
| 35 | * Setup the directory structure and start files |
||
| 36 | <pre>mkdir -p /etc/ssl/newcert |
||
| 37 | echo "01" > /etc/ssl/serial |
||
| 38 | touch /etc/ssl/index.txt |
||
| 39 | perl -e "print int(rand(90)+10)" > rand |
||
| 40 | </pre> |
||
| 41 | |||
| 42 | h3. Generate a jabber host key and sign it |
||
| 43 | |||
| 44 | Note: these directions are incomplete because I'm trying out updated directions on star certificates at: |
||
| 45 | http://blog.bigdinosaur.org/openfire-and-ssl-slash-tls-certificates/ |
||
| 46 | |||
| 47 | * Generate the key and signing requiest. (no password) |
||
| 48 | <pre>openssl req -newkey rsa:1024 -keyout host_jabber.ru.is-key.pem -nodes -out host_jabber.ru.is-req.pem</pre> |
||
| 49 | * Now sign the key |
||
| 50 | <pre>openssl ca -out jabber.ru.is-crt.pem -infiles jabber.ru.is-req.pem</pre> |
||
| 51 | * Now convert the certificate to PKS#7 format |
||
| 52 | <pre>openssl crl2pkcs7 -nocrl -certfile jabber.ru.is-crt.pem -out jabber.ru.is-crt.p7b -certfile cacert.pem</pre> |