Certifikačná autorita

Vyroda certifikacnej autority

Vyroba adresarov Certifikacnej Autority

cd /etc/ssl
mkdir CA
cd CA
mkdir certs crl newcerts private
echo 01 > serial
touch index.txt
chmod -R 600 .
chmod -R u+X .

Generovanie certifikatu CA

cd /etc/ssl/CA
openssl req -new -x509 -out cacert.pem -keyout private/cakey.pem -days 1461
chmod 400 private/cakey.pem
  • cacert.pem - certifikat CA (vygeneruje sa)
  • cakey.pem - tajny kluc CA (vygeneruje sa)
  • parametrom -nodes dosiahneme, ze kluc nebude sifrovany
  • ak chceme tento certifikat podpisat inou certifikacnou autoritou (nechceme, aby uz viac bol self-signed), podpiseme ho pomocou:
openssl ca -ss_cert cacert.pem -out cert.pem -days 1461

Vyroba certifikatu

Najprv potrebujeme ziadost o certifikat.

Vyroba ziadosti o certifikat

cd /etc/ssl
openssl req -new -nodes -out request.pem -keyout key.pem
  • request.pem - ziadost o certifikat (vygeneruje sa, obsahje verejny kluc)
  • key.pem - tajny kluc (vygeneruje sa)

Ziadost o certifikat podhodime certifikacnej autorite, ktora nam ju potvrdi (vystavi certifikat)

Vydanie certifikatu

cd /etc/ssl
openssl ca -in request.pem -out cert.pem -days 365
  • cert.pem - certifikat (vygeneruje sa, je to vlastne vas verejny kluc podpisany certifikacnou autoritou)

Ďalšie tipy a triky

Samostatné vytvorenie súkromného kľúča

openssl genrsa -out mykey.pem 1024

Ak chceme kľúč zašifrovať heslom,pridáme parameter -des3

Vytvorenie verejného kľúča k súkromnému

openssl rsa -in mykey.pem -pubout

Vytvorenie žiadosti o certifikát k existujúcemu súkromnému kľúču

openssl req -new -key mykey.pem -out myreq.pem

Informácie o certifikáte

Vypísanie informácií o certifikáte:

openssl x509 -text -in cert.pem

Vypísanie vybranej informácie (issuer):

openssl x509 -noout -in cert.pem -issuer

Rovnako je možnépoužiť aj -subject -dates -hash -fingerprint

PKCS12

Konverzia do pkcs12 (vrátane súkromného kľúča a chainu):

cat cacert1.pem cacert2.pem cert.pem | openssl pkcs12 -inkey key.pem -export -name "myname" > output.p12

Ak to chceme bez hesla, tak pripojímeparameter -nodes.

Zmena hesla existujúceho pkcs12
openssl pkcs12 -in cert.p12 -nodes | openssl pkcs12 -export -out cert.p12

Konverzia z PEM do DER

Certifikát:

openssl x509 -inform PEM -outform DER -in cert.pem -out cert.der

Kľúč:

openssl rsa -inform PEM -outform DER -in key.pem -out key.der

Client

https: HTTP over SSL

openssl s_client -connect remote.host:443

The s_server option allows you to set up an SSL-enabled server from the command line, but it’s I wouldn’t recommend using it for anything other than testing or debugging. If you need a production-quality wrapper around an otherwise insecure server, check out Stunnel instead.

Server

The s_server option works best when you have a certificate; it’s fairly limited without one. the -www option will sent back an HTML-formatted status page to any HTTP clients that request a page

openssl s_server -cert mycert.pem -www

the -WWW option “emulates a simple web server. Pages will be resolved relative to the current directory.” This example is listening on the https port, rather than the default port 4433

openssl s_server -accept 443 -cert mycert.pem -WWW

Hashe

MD5 hash:

openssl dgst -md5 filename

SHA1 hash:

openssl dgst -sha1 filename

Jednoduché šifrovanie a dešifrovanie

openssl enc -aes-256-cbc < file.txt > file.txt.enc

Dešifrovanie:

openssl enc -aes-256-cbc -d < file.txt.enc > file.txt

Parametre openssl.cnf

basicConstraints

  • CA:TRUE - pre certifikacne autority
  • CA:TRUE, pathlen:0 - parameter pathlen hovori, kolko urovni certifikacnych autorit pod nou moze byt (v tomto pripade ide o certifikacnu autoritu poslednej urovne)
  • CA:FALSE - pre koncove certifikaty

nsCertType

netscape certificate type

  • client - SSL Client
  • server - SSL Server
  • email - S/MIME or SSL Client
  • objsign - Object Signing - Netscape Object Signing is a protocol that lets developers create applications that can request fine-grained access to a user's system resources.
  • reserved
  • sslCA - SSL Client CA
  • emailCA - SSL Client CA or S/MIME Client CA
  • objCA - Object Signing CA

keyUsage

PKIX key usage

  • digitalSignature - digitalny podpis
  • nonRepudiation - nepopieratelnost
  • keyEncipherment - sifrovanie klucov
  • dataEncipherment - sifrovanie uzivatelskych dat
  • keyAgreement
  • keyCertSign - indicating to use the subject public key for verifying a signature on certificates
  • cRLSign
  • encipherOnly
  • decipherOnly

extendedKeyUsage

  • serverAuth - SSL/TLS Web Server Authentication.
  • clientAuth - SSL/TLS Web Client Authentication.
  • codeSigning - Code signing.
  • emailProtection - E-mail Protection (S/MIME).
  • timeStamping - Trusted Timestamping
  • msCodeInd - Microsoft Individual Code Signing (authenticode)
  • msCodeCom - Microsoft Commercial Code Signing (authenticode)
  • msCTLSign - Microsoft Trust List Signing
  • msSGC - Microsoft Server Gated Crypto
  • msEFS - Microsoft Encrypted File System
  • nsSGCNetscape - Server Gated Crypto

Zdroje

 
ca.txt · Last modified: 04.08.2011 18:20 by 158.195.15.33
 
Recent changes RSS feed Creative Commons License Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki