(I had this buried in a pile of electronic notes I was cleaning up…I think it’s originally from our Resomp days. Anyways, it has been useful to us in the past, so I thought maybe it would be useful to others in the future. Updates to me.)
These are rough and ready notes on how to create your own cert-signing CA for use with OpenSSL so you can do limited generation of site-specific certs:
Why?
Basically, to save yourself some cash. While there are many
real certificate authorites (Verisign and Thawte being two
common ones… check your browsers certificate signer list for
more), they all charge you money in order to sign your SSL
certificate. While it is important to have your site
certificate signed by a trusted authority if you are running an
online business, it is less important if you are simply
concerned about password and account security and would like to
have services such as imaps (SSL secured IMAP) and https (SSL
secured HTTP). It is for these people that this HOWTO is
written.
Software
I used the OpenSSL package, available from
http://www.openssl.org. Be aware that if you use this package
in the USA, you need to obtain and install the RSAREF toolkit,
in order to be complient with silly US patent laws. The rest of
this HOWTO assumes that you are using this package.
Configuring OpenSSL
We use a homerolled packaging system called /opt. It works
pretty well with apps that use Autoconf, but OpenSSL doesn’t,
so here’s what you have to do:
./Configure --openssldir=/opt/openssl-0.9.3a
linux-elf
will configure it properly. the --prefix flag
doesn’t do the Right Thing. After installing, move all programs
in the misc subdir into bin, and make a symlink from the
openssl binary to ssleay for backwards compatability.
Now, you have to configure the openssl.cnf file, and setup
your CA. Make the following changes to the openssl.cnf,
replacing CA_rescomp.berkeley.edu with your own CA name.
set default_ca to CA_rescomp.berkeley.edu
change [ CA_default ] to [ CA_rescomp.berkeley.edu ]
set dir to /opt/openssl/CA_rescomp.berkeley.edu
set countryName_default = US
set stateOrProvinceName_default = California
set localityName_default = Berkeley
set 0.organizationName_default = Office of Residential Computing, UC Berkeley
uncommented keyUsage
uncommented subjectAltName
uncommented issuerAltName
uncommented keyUsage under [ v3_ca ]
uncommented [ v3_ca ] subjectAltName and issuerAltName
uncommented [ crl_ext ] issuerAltName
mkdir /opt/openssl/CA_rescomp.berkeley.edu, and chmod 700.
Then, edit the CA.pl and change the $CATOP variable to point to
./CA_rescomp.berkeley.edu”
Setting up your very own CA
Run CA.pl -newca. Hit Enter to create a new CA,
and enter a signing passphrase. THIS IS VERY IMPORTANT! If this
signing keypair is lost or compromised, then all of the keys
that you have signed are also compromised. Accept all of the
defaults (which you setup in your openssl.cnf), and use
ca@yourdomain.com as your email addr. (Be sure that
ca@yourdomain.com actually points to someone useful, as this is
where certificate requests will go). It is
very important to protect the CA_rescomp.berkeley.edu
directory. Ideally, it should be stashed on a floppy somewhere
safe, and only taken out when needed to sign new certificates.
If this directory is compromised, you’ll need to start all
over, and invalidate all of your certs that have been signed
with your CA. This sucks, so don’t let it happen to you.
Now, you need to put your CA’s public key in your SSL key
database. For example, I setup all of my SSL enabled tools
(stunnel and mod_ssl) to use /opt/openssl/ca-certs. The odd
looking symlink is the x509 hash, which is a unique identifier
stored in the client certificate, which allows the server to
locate the proper signing authorities key.
mkdir /opt/openssl/ca-certs
cp CA_rescomp.berkeley.edu/cacerts.pem ca-certs/rescomp.berkeley.edu.pem
cp -a src/certs/* /opt/openssl/ca-certs
cd ca-certs
ln -s rescomp.berkeley.edu.pem $(openssl x509 -noout -hash < rescomp.berkeley.edu.pem).0
Now your’ve got your Certificate Authority up and running.
Stunnel Certificates
openssl req -new -keyout imapd.pem -out imapd.pem -nodes
openssl ca -policy policy_anything -out imapd.cert.pem -infiles imapd.pem
cat these files together (cert then key)
mod_ssl Certificates
generate as above
common name is the FQDN of the webserver
cat them together (cert then key)
To add the CA to Netscape
add to the httpd.conf
AddType application/x-x509-ca-cert cacert
cp CA_rescomp.berkeley.edu/cacert.pem to a web accessible place
To create client certificates for Netscape
openssl req -new -keyout username.key.pem -out username.pem
openssl ca -policy policy_anything -out username.cert.pem -infiles username.pem
openssl pkcs12 -export -in username.pem -inkey username.key.pem -certfile /opt/openssl/ca-certs/rescomp.berkeley.edu.pem -name "username@rescomp.berkeley.edu certificate" -out username.p12
Import into Netscape
To create client certificates in Netscape
setup html and cgi files
get cert request in /opt/apache/data/cert-reqs/filename.random
openssl ca -policy policy_anything -spkac clireq1234.1234565773 -out signed1.cert
Added to httpd.conf
AddType application/x-x509-user-cert cert
cp signed cert to filename.cert and download in Netscape
Read Full Post »
Rand Wacker 