{"id":521,"date":"2012-05-07T20:50:31","date_gmt":"2012-05-07T18:50:31","guid":{"rendered":"\/\/www.mcgill.org.za\/stuff\/?page_id=521"},"modified":"2012-05-07T21:18:45","modified_gmt":"2012-05-07T19:18:45","slug":"instant-certificate-authority-script","status":"publish","type":"page","link":"https:\/\/www.mcgill.org.za\/stuff\/software\/instant-certificate-authority-script","title":{"rendered":"Instant Certificate Authority script"},"content":{"rendered":"<p>Some software believes passionately in certificates signed by certificate authorities (CA), and will not budge without it.\u00a0 This means that often enough you want to be your own CA.  You cannot trust the likes of Diginotar to protect your interests: you need your own certificate authority on your own system &#8230; and you need it to be simple, because it should be.  On days like this, you need an <b>instant<\/b> way of setting it up, which is what this script is.  <\/p>\n<p>Characteristics of scripts produced by this script:<\/p>\n<ul>\n<li>SSL certificate and CA certificate are valid for 30 years: you can run this hack once, not once per year<\/li>\n<li>Common Name is what you specify, everything else is default values.<\/li>\n<li>Signed by your personal certificate authority, &#8216;ca&#8217;<\/li>\n<\/ul>\n<p>If you use this for something serious then take note:<\/p>\n<ul>\n<li>CA files are <i>NOT<\/i> password protected: this is for a fast and usable solution. Secure your operating system and use encrypted storage (and don&#8217;t blame me).<\/li>\n<li>If you are still using these certificates 30 years after you generate them, you&#8217;ll need to replace them.<\/li>\n<li>There is no practical provision for a certificate revocation list (CRL).  If you lose a certificate, you should generate a new CA and new certificates.<\/li>\n<li>If it eats your shorts, you can sue me only for the amount you pay me.<\/li>\n<\/ul>\n<h2>Download<\/h2>\n<p><a href=\"\/software\/ca\/instant-ssl-ca\">instant-ssl-ca<\/a> : bash shell script<br \/>\nLicence: GPL (GNU Public Licence v3)<\/p>\n<h2>Usage<\/h2>\n<p>This command gets you:<\/p>\n<ul>\n<li>a 30 year CA<\/li>\n<li>a CA-signed certificate for server.localdomain<\/li>\n<li>a CA-signed certificate for client.localdomain<\/li>\n<\/ul>\n<p>It&#8217;s pretty simple &#8211; the hard part is to copy the certificate to where you want it after it has been generated.<\/p>\n<pre>\r\n$ <b>.\/instant-ssl-ca --ssl server.localdomain client.localdomain<\/b>\r\n\r\n*****************************************************************\r\nMaking key named server.localdomain\r\n*****************************************************************\r\n\r\n*****************************************************************\r\nCreating Certificate Authority: ca.{key,crt}\r\n*****************************************************************\r\nGenerating a 1024 bit RSA private key\r\n...............++++++\r\n.......++++++\r\nwriting new private key to 'ca\/ca.key'\r\n-----\r\nYou are about to be asked to enter information that will be incorporated\r\ninto your certificate request.\r\nWhat you are about to enter is what is called a Distinguished Name or a DN.\r\nThere are quite a few fields but you can leave some blank\r\nFor some fields there will be a default value,\r\nIf you enter '.', the field will be left blank.\r\n-----\r\nCountry Name (2 letter code) [ZA]:State or Province Name (full name) [Somewhere]:Locality Name (eg, city) [Someplace]:Organization Name (eg, company) [Somepeople]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) [ca]:Email Address [someone@somewhere.else]:\r\n*****************************************************************\r\nCreating certificate signing request server.localdomain.csr\r\n*****************************************************************\r\nGenerating a 1024 bit RSA private key\r\n...++++++\r\n........++++++\r\nwriting new private key to 'server.localdomain.key'\r\n-----\r\nYou are about to be asked to enter information that will be incorporated\r\ninto your certificate request.\r\nWhat you are about to enter is what is called a Distinguished Name or a DN.\r\nThere are quite a few fields but you can leave some blank\r\nFor some fields there will be a default value,\r\nIf you enter '.', the field will be left blank.\r\n-----\r\nCountry Name (2 letter code) [ZA]:State or Province Name (full name) [Somewhere]:Locality Name (eg, city) [Someplace]:Organization Name (eg, company) [Somepeople]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) [server.localdomain]:Email Address [someone@somewhere.else]:\r\nPlease enter the following 'extra' attributes\r\nto be sent with your certificate request\r\nA challenge password []:An optional company name []:\r\n*****************************************************************\r\nCertificate authority signing certificate => server.localdomain.crt\r\n*****************************************************************\r\nUsing configuration from ca\/openssl.cnf\r\nCheck that the request matches the signature\r\nSignature ok\r\nThe Subject's Distinguished Name is as follows\r\ncountryName           :PRINTABLE:'ZA'\r\nstateOrProvinceName   :PRINTABLE:'Somewhere'\r\nlocalityName          :PRINTABLE:'Someplace'\r\norganizationName      :PRINTABLE:'Somepeople'\r\ncommonName            :PRINTABLE:'server.localdomain'\r\nemailAddress          :IA5STRING:'someone@somewhere.else'\r\nCertificate is to be certified until Apr 30 18:28:28 2042 GMT (10950 days)\r\nSign the certificate? [y\/n]:\r\n\r\n1 out of 1 certificate requests certified, commit? [y\/n]Write out database with 1 new entries\r\nData Base Updated\r\n\r\n*****************************************************************\r\nOutput directory is .\/server.localdomain\r\n*****************************************************************\r\n\r\n*****************************************************************\r\nMaking key named client.localdomain\r\n*****************************************************************\r\nCA: ca\/ca.key and ca\/ca.crt exist\r\n\r\n*****************************************************************\r\nCreating certificate signing request client.localdomain.csr\r\n*****************************************************************\r\nGenerating a 1024 bit RSA private key\r\n................................................................++++++\r\n...........++++++\r\nwriting new private key to 'client.localdomain.key'\r\n-----\r\nYou are about to be asked to enter information that will be incorporated\r\ninto your certificate request.\r\nWhat you are about to enter is what is called a Distinguished Name or a DN.\r\nThere are quite a few fields but you can leave some blank\r\nFor some fields there will be a default value,\r\nIf you enter '.', the field will be left blank.\r\n-----\r\nCountry Name (2 letter code) [ZA]:State or Province Name (full name) [Somewhere]:Locality Name (eg, city) [Someplace]:Organization Name (eg, company) [Somepeople]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) [client.localdomain]:Email Address [someone@somewhere.else]:\r\nPlease enter the following 'extra' attributes\r\nto be sent with your certificate request\r\nA challenge password []:An optional company name []:\r\n*****************************************************************\r\nCertificate authority signing certificate => client.localdomain.crt\r\n*****************************************************************\r\nUsing configuration from ca\/openssl.cnf\r\nCheck that the request matches the signature\r\nSignature ok\r\nThe Subject's Distinguished Name is as follows\r\ncountryName           :PRINTABLE:'ZA'\r\nstateOrProvinceName   :PRINTABLE:'Somewhere'\r\nlocalityName          :PRINTABLE:'Someplace'\r\norganizationName      :PRINTABLE:'Somepeople'\r\ncommonName            :PRINTABLE:'client.localdomain'\r\nemailAddress          :IA5STRING:'someone@somewhere.else'\r\nCertificate is to be certified until Apr 30 18:28:28 2042 GMT (10950 days)\r\nSign the certificate? [y\/n]:\r\n\r\n1 out of 1 certificate requests certified, commit? [y\/n]Write out database with 1 new entries\r\nData Base Updated\r\n\r\n*****************************************************************\r\nOutput directory is .\/client.localdomain\r\n*****************************************************************\r\n<\/pre>\n<p>So, what did we get?  We got a CA certificate (called &#8220;ca&#8221;) and two client certificates: one called &#8220;client.localdomain&#8221;, and the other called &#8220;server.localdomain&#8221;.<\/p>\n<pre>\r\n$ <b>find <\/b>\r\n.\r\n.\/client.localdomain\r\n.\/client.localdomain\/client.localdomain.crt\r\n.\/client.localdomain\/client.localdomain.pem\r\n.\/client.localdomain\/client.localdomain.key\r\n.\/client.localdomain\/ca.crt\r\n.\/.rnd\r\n.\/ca\r\n.\/ca\/01.pem\r\n.\/ca\/ca.key\r\n.\/ca\/index.txt\r\n.\/ca\/index.txt.attr\r\n.\/ca\/index.txt.attr.old\r\n.\/ca\/serial\r\n.\/ca\/index.txt.old\r\n.\/ca\/02.pem\r\n.\/ca\/serial.old\r\n.\/ca\/ca.crt\r\n.\/ca\/openssl.cnf\r\n.\/ca\/ca.der\r\n.\/server.localdomain\r\n.\/server.localdomain\/server.localdomain.pem\r\n.\/server.localdomain\/server.localdomain.key\r\n.\/server.localdomain\/server.localdomain.crt\r\n.\/server.localdomain\/ca.crt\r\n.\/instant-ssl-ca\r\n<\/pre>\n<h2>Applications<\/h2>\n<p>Things that you will use this for:<\/p>\n<ul>\n<li>Internal HTTP, POP3 and SMTP certificates: If you install your value-free CA company-wide in your end users&#8217; browsers, you can issue the certificates for https, pop3s and smtps \/ starttls, and decommission all those self-signed certificates you have floating around.  For security, it would be better to have separate CA&#8217;s for mysql, VPN&#8217;s and mail\/web.  Actually, a certificate chain would be ideal, and this tool doesn&#8217;t do that.  It&#8217;s just the basic stuff.\n<\/li>\n<li><a href=\"http:\/\/dev.mysql.com\/doc\/refman\/5.0\/en\/secure-create-certs.html\" title=\"MySQL howto on setting up SSL\" target=\"_blank\">mysql<\/a>: SSL certificates prevent your data from being sniffed.  To set up a SSL connection, generate a certificate and copy it to the server.<br \/>\nYou configure the certificate in the server&#8217;s my.cnf, and then restart:<\/p>\n<pre>ssl-ca=\/etc\/mysql\/ssl\/ca.crt\r\nssl-key=\/etc\/mysql\/ssl\/server.localdomain.key\r\nssl-cert=\/etc\/mysql\/ssl\/server.localdomain.crt<\/pre>\n<p>Do the grant like this:<\/p>\n<pre>GRANT ALL PRIVILEGES \r\n  ON `database_name`.* to 'username'@'%' \r\n  IDENTIFIED BY 'password' \r\n  <b>REQUIRE SSL<\/b>;\r\n<\/pre>\n<p>The client side connection is:<\/p>\n<pre>mysql --ssl-ca=$HOME\/.mysql\/ca.crt \\\r\n    --ssl-key=$HOME\/.mysql\/client.localdomain.key \\\r\n    --ssl-cert=$HOME\/.mysql\/client.localdomain.crt \\\r\n    -u 'username -p'password' -h 'server.localdomain' database_name<\/pre>\n<\/li>\n<li><a href=\"http:\/\/openvpn.net\/index.php\/open-source\/documentation\/howto.html#pki\" title=\"OpenVPN PKI howto\" target=\"_blank\">openvpn<\/a> &#8211; generating the certificate files is the most painful part of the configuration.<br \/>\nThe certificate parts of the openvpn client configuration are:<\/p>\n<pre>openvpn --client \\\r\n    --tls-remote server.localdomain \\\r\n    --ca ca.crt  --cert client.localdomain.crt --key client.localdomain.key\r\n<\/pre>\n<p>The relevant parts of the openvpn server configuration:<\/p>\n<pre>openvpn --server 10.123.0.0 255.255.255.0 \\\r\n    --ca ca.crt --cert server.localdomain.crt --key server.localdomain.key\r\n<\/pre>\n<\/li>\n<li><a href=\"http:\/\/www.rabbitmq.com\/troubleshooting-ssl.html\" title=\"RabbitMQ's SSL troubleshooting guide\" target=\"_blank\">Rabbitmq<\/a>: Rabbitmq and erlang&#8217;s SSL support likes its certificate in RSA format, so you have to convert it from PEM (sorry about this &#8211; it&#8217;s a bit of a bug):\n<pre>openssl rsa < server.localdomain.key  > server.localdomain.rsakey<\/pre>\n<p>Now you can configure it thusly:<\/p>\n<pre>[\r\n  {rabbit, [\r\n    {ssl_listeners,[5671]},\r\n    {ssl_options, [{cacertfile,\"\/etc\/rabbitmq\/ca.crt\"},\r\n                    {certfile,\"\/etc\/rabbitmq\/server.localdomain.crt\"},\r\n                    {keyfile,\"\/etc\/rabbitmq\/server.localdomain.rsakey\"},\r\n                    {verify,verify_peer},\r\n                    {fail_if_no_peer_cert,true}]}\r\n  ]}\r\n].<\/pre>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Some software believes passionately in certificates signed by certificate authorities (CA), and will not budge without it.\u00a0 This means that often enough you want to be your own CA. You cannot trust the likes of Diginotar to protect your interests: &hellip; <a href=\"https:\/\/www.mcgill.org.za\/stuff\/software\/instant-certificate-authority-script\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":410,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-521","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/pages\/521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/comments?post=521"}],"version-history":[{"count":20,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/pages\/521\/revisions"}],"predecessor-version":[{"id":534,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/pages\/521\/revisions\/534"}],"up":[{"embeddable":true,"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/pages\/410"}],"wp:attachment":[{"href":"https:\/\/www.mcgill.org.za\/stuff\/wp-json\/wp\/v2\/media?parent=521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}