|
||||||
|
Home Genealogie Hemochromatose Certificaat Test Manuals Korn shell SQL commands Robots.txt Encoding SSL setup WSDL definition XSLT scrips |
Table of contents1 - PrefaceThis guide explains how to setup a root certification authority (CA) on Linux, and how to implement apache ssl on Linux.A Certification Authority (CA) holds a selfsigned key that is able to sign other keys. Large commercial CA's like Verisign use this exact same procedure as described in this document. Only these commercial CA's have installed there root certificate within the most browsers, so you don't have to manualy install the root certificate of Verisign. Microsoft and Netscape did already do this for us. You can use a Verisign certificate for your own HTTPS server, but this is very expensive. But we can create our own CA, the only thing your visitors have to do is install your root certificate. We can use our CA to sign any certificate, like for HTTPS, SSH, VPN, E-Mail and any other application that can use a certificate. 1.6 - Certificates explainedCertificates are a way to encrypt and decrypt information without first discussing the encryption key and authenticating the identity of the sender. In the past when someone wanted to send an encrypted message to another person, both the sender and the receiver had to agree on a secret encryption key. They had to find a way to secretly pass the encryption key to each other.E.g. Bob wants to send Alice a message. Bob and Alice agree to send the words in the message backwards (ok, this is easy to hack, but it's just an example). Bob send "olleh" to Alice. Alice knows that the message must be reversed to decrypt it, so Alice reads "hello". Mallod is listening to the messages between Bob and Alice does not understand the message since he reads only the "olleh" message, and he does not know the secret encryption key Alice and Bob have agreed on. (Ok, Mallod must be a complete idiot not to guest the key...). The big disadvantage of this method is that both the sender and receiver must know the exact encryption key before they can start communicating. And how can you be sure that nobody else will 'hear' what you agree on.
1.7 - Signing explainedWith only a certificate we can encrypt and decrypt information, but sometimes you only want to know is the person you are talking with is realy the person that is tells you he is. The person can encrypt data and send it to you. if you have his public key, you know only he could encrypt data. But where did you get his public key from? E.g. on HTTPS the server itself sends you its public key when you make your initial contact.To make sure that a person is really the person he says he is, you would like to ask someone who you can trust. This is exact what signing is about. A certificate can be signed by a Certification Authority (CA). A CA is nothing more' than an orginazion that gives out a signature saying that the holder of the signature is checked by this organization. When you connect to a bank using HTTPS, the bank server will send you its public key at the initial connection. But this public key is signed by a CA. So this public key holds an encrypted message from the CA, which is encrypted using the CA's private key. Your browser uses the CA's public key to decrypt this CA's message in the banks certificate. The CA's message contains some information about the banks server, e.g. the domain name. Your browser checks this information with the banks server. E.g. the CA's message tells you that the banks domain name is www.bank.com, so if the banks server suddenly uses www.bogus.com, you will know that the 'misconceived' bank server is now the server it tells you it is. 1.8 - Single Sign OnSigning can not only be used to authenticate servers, but can also be used to authenticate a client or user. When a number of servers are used for 1 single company or task. It would be very unpleasant to login on all servers individually. You can create your own personal certificate pair and sign them at a CA. Now you can store your personal public key in all the servers and tell those servers that this key belongs to your login code. Now when you connect to one of these servers, you send your public key encrypted using your private key to the server instead of sending your username and password. The server decrypts your encrypted public key using your private key and checks this key against the stored key. if the keys match, you are logged in.An other way to handle a larger group of users is to configure the server so that it will accept all users with a personal key that is signed by a specific CA. Normally this is a special CA and not a public one. So only the CA has to check that a users is valid to use a specific application. The server checks the CA to see if a user is permitted to connect. This is where directory services (like Microsofts Active Directory) come in handy. 
1.9 - SSL explainedThe basic functionality of SSL (Secured socket layer) is to:
The process for generating a certificate that is signed by a root certificate, you will have to follow the next procedure:
2 - Install3 - Create root certificateThe root certificate is used to authenticate all other certificates that are generated using the root certificate. This way only the root certificate must be installed in e.g. the Internet browser and all other certificates are than authenticated.The root certificate is made up by 2 keys, just like any other certificate. The root certificate is a self signing key, exept that the DN (common name) is not the website but an describing name (e.g. Schaake root Certificate). The cakey.key is the private key and must be kept save, since this will be the server key to sign other keys. And you don't want others to be able to sign your keys! The cacert.crt is the public key, this key must be installed in a visitors browser. So publish this key on your website. openssl req -new -x509 \ -keyout /var/ssl/private/cakey.key \ -out /var/ssl/certs/cacert.crt -days 3650 cp /var/ssl/certs/cacert.crt /var/www/html/sslThe first command generates the selfsiging key request and will generate the server and public keys. The copy command copies the public key to the website (apache 2.0 on Redhat). Create a hyperlink to the key at your web pages. The option days will set the number of days the certificate will remain valid. Normally we would like to set it to only 1 year. But we don't want our visitors to install a new root certificate every year. And we also don't want to create new certificates for all services every year. So only for the root certificate, set the expiring period to 10 years. 4 - Certificate requestMost applications can create there own certification request, but we can also do this using the openssl command. On the common name (CN) enter the hostname, email address or application name that is going to use this certificate. You have to supply the exact name in the DN field, since this is the only field that is checked to see if the certificate belongs to this source.openssl req -new -keyout /var/ssl/private/www-schaake-nu.key \ -out /var/ssl/requests/www-schaake-nu.csr -days 365The .key file is the private key (keep this save). The .csr file is the certification request. This includes the public key and all other information about the request. Normally you would send this file to the CA. 5 - Sign a certificateopenssl ca -out /var/ssl/certs/www-schaake-nu.crt \ -infiles /var/ssl/requests/www-schaake-nu.csr 6 - Revoke a certificateopenssl ca -revoke /var/ssl/certs/www-schaake-nu.crt openssl ca -gencrl -out /var/ssl/crl/schaake-ca.crl cp /var/ssl/crl/schaake-ca.crl /var/www/html/ssl cp /var/ssl/crl/schaake-ca.crl /etc/httpd/conf/ssl.crl 7 - Renew a certificate8 - View a certificateopenssl x509 -in /var/ssl/certs/www-schaake-nu.crt -noout -text 9 - Apache 2.0 howto9.1 - Certificate requestopenssl genrsa 1024 > /etc/httpd/conf/ssl.key/www-schaake-nu.key openssl req -new -key /etc/httpd/conf/ssl.key/www-schaake-nu.key \ -out /etc/httpd/conf/ssl.csr/www-schaake-nu.csr cp /etc/httpd/conf/ssl.csr/www-schaake-nu.csr /var/ssl/requests 9.2 - Setup SSL10 - Outlook email howto10.1 - Sign an emailopenssl pkcs12 -export -in /var/ssl/certs/postmaster@schaake-nu.crt \ -inkey /var/ssl/private/postmaster@schaake-nu.pem \ -out /var/ssl/certs/postmaster@schaake-nu.p12 \ -name "Schaake Postmaster" 10.2 - Encrypt an email11 - Converting certificatesTo convert a private key from PEM (default openssl format) to DER (default MS format)openssl rsa -in /var/ssl/private/www-schaake-nu.key \ -out /var/ssl/private/www-schaake-nu.der \ -outform DER To convert a certificate from PEM (default openssl format) to DER (default MS format) openssl x509 -in /var/ssl/certs/www-schaake-nu.crt -out /var/ssl/certs/www-schaake-nu.der -outform DER 12 - Combined client certificate and Basic authentication with Apache and PHPThis chapter describes how to setup client certificate authentication combined with Basic Authentication when no valid client certificate was given.First setup a Root CA and Apache SSL before you can continue. Now create a client certificate. First create a certificate request (as shown in a previous chapter). Only set the CN (or Common Name) to a user name you want the certificate to be used for. Sign the certificate, and now you have a private and public pair for your client certificate. for some reason all webbrowsers only accept pk12 certificates, so you have to convert the certificates using the next command. openssl pkcs12 -export -in /var/ssl/certs/cc-test.crt \ -inkey /var/ssl/private/cc-test.pem \ -out /var/ssl/certs/cc-test.p12 \ -name "Test Client Certificate"Now you can import this client certificate in any webbrowser. Next we have to configure is the web server. for our test we will use a specific directory for testing purposes. So make add the next location in you httpd.conf, we are going to use https://www.webserver.com/cert as testing area. <Location /cert>
# Client authentication stuff
SSLVerifyClient optional # Can be optional or required
SSLVerifyDepth 2
SSLOptions +FakeBasicAuth # I'm not sure about this option
</Location>
Now we can connect to this directory with our certificate. if things won't work, check your server logfiles. And make sure
you have configure you server for SSL. (TIP: Check your servers DNS name, this must be the same as in the CA certificate use for
signing your client certificate).Now we only have to build a script to check if the certificate is valid, and if no certificate was provided, do basis authentication. <?
// Check if and how we are authenticated
if ($_SERVER['SSL_CLIENT_VERIFY'] != "SUCCESS") { // Not using a client certificate
if ((!$_SERVER['PHP_AUTH_USER']) && (!$_SERVER['PHP_AUTH_PW'])) { // Not logged in using basic authentication
authenticate(); // Send basic authentication headers
}
}
if ($_SERVER['SSL_CLIENT_S_DN_CN'] != "chris") { // Check CN name of cert
if (!(($_SERVER['PHP_AUTH_USER'] == "test") && ($_SERVER['PHP_AUTH_PW'] == "123"))) { // Check username and password
authenticate(); // Send basic authentication headers because username and/or password didnot match
}
}
phpinfo();
// ------------------------------------------------------------------------
// authenticate()
//
// Call authentication display
// ------------------------------------------------------------------------
function authenticate() {
Header("WWW-Authenticate: Basic realm=Website");
Header("HTTP/1.0 401 Unauthorized");
error401();
exit;
}
?>
What you will have to include yourself is:
A number of browsers can have an additional password on the certificate, so a user will have to enter a password when the server requists the client certificate. But this is an optional service, so don't depend on it. You could also do a client certification check and a username password check, just mixup the script... |
Amé Schaake Senna Schaake 
|
||||
| © Christiaan Schaake | Laatste update January 16 2011 | |||||
