Projekt PKI - Revision history

Joachim at 11:01, 13 January 2023

2023-01-13T11:01:12Z

← Older revision		Revision as of 11:01, 13 January 2023
Line 1:		Line 1:
	= PKI für meine SSL Verbindungen =		= PKI für meine SSL Verbindungen =

			see also [[Project_LetsEncrypt]]

	== Installation ==		== Installation ==

2022-03-23T17:15:38Z

Cert Checking

← Older revision		Revision as of 17:15, 23 March 2022
Line 135:		Line 135:
	=== Client ===		=== Client ===
	openssl s_client -crlf -connect localhost:4433 -servername banzhaf.chickenkiller.com		openssl s_client -crlf -connect localhost:4433 -servername banzhaf.chickenkiller.com

			=== Client Certs ===

			could probably work as well: -CAfile infile.pem on server and -cert on client

2022-03-23T17:12:36Z

PKI für meine SSL Verbindungen

← Older revision		Revision as of 17:12, 23 March 2022
Line 125:		Line 125:

	http://heartbleed.com/		http://heartbleed.com/

			== Cert Checking ==
			openssl cli can be used to test client/server TLS connection.
			Or just use it to send data back and forth securely to a verified server.

			=== Server ===
			openssl s_server -crlf -cert /etc/letsencrypt/live/banzhaf.chickenkiller.com/fullchain.pem -key /etc/letsencrypt/live/banzhaf.chickenkiller.com/privkey.pem

			=== Client ===
			openssl s_client -crlf -connect localhost:4433 -servername banzhaf.chickenkiller.com

2014-04-10T13:38:09Z

How to use openSUSE CA management instead

← Older revision		Revision as of 13:38, 10 April 2014
Line 119:		Line 119:
	* openssl commands are intransparent, i.e. no learning curve		* openssl commands are intransparent, i.e. no learning curve
	* more difficult to use for features not implemented in the gui		* more difficult to use for features not implemented in the gui

			== Heartbleed ==

			Damn. Just implemented the PKI and now I can issue new certs already. Very nice! :(

			http://heartbleed.com/

2014-04-08T13:33:32Z

Implementation

← Older revision		Revision as of 13:33, 8 April 2014
Line 66:		Line 66:
	==== Implementation ====		==== Implementation ====

	I modified easyrsa pkitool from openvpn to modify openssl.conf on the fly		I modified easyrsa pkitool from openvpn to modify openssl.conf on the fly.
			This does not work yet (the certificate did not include the alternate names). So for now use the yast ca (see below).

	--- pkitool.orig 2013-11-01 12:22:05.000000000 +0100		--- pkitool.orig 2013-11-01 12:22:05.000000000 +0100

2014-04-03T17:25:15Z

How to add alternate subjects to certificates

@@ Line 45: / Line 45: @@
 === How to add alternate subjects to certificates ===
 This is required for an ssl connection (webserver or whatever) to be valid for more than one name (e.g. localhost, job4, job4.job.de, banzhaf.chickenkiller.com)
 Certificates can include extensions. One extension is SubjectAltName.
@@ Line 60: / Line 64: @@
 The SubjectAltName needs to be defined in the openssl.conf or in a file given with -extfile
-The openssl.conf should not change all the time. Also if I use env vars for the values, at least the key would be included.
+==== Implementation ====
-That's why I'll try using the -extfile option and create the file if necessary.
-I use easyrsa pkitool from openvpn as a start
+set unique_subject = no in keys/index.txt.attr
 === How to use openSUSE CA management instead ===

2014-04-03T16:10:23Z

How to add alternate subjects to certificates

← Older revision		Revision as of 16:10, 3 April 2014
Line 61:		Line 61:

	The openssl.conf should not change all the time. Also if I use env vars for the values, at least the key would be included.		The openssl.conf should not change all the time. Also if I use env vars for the values, at least the key would be included.
	That's why I'll try using the -extfile option and create the file if necessary.		That's why I'll try using the -extfile option and create the file if necessary.

			I use easyrsa pkitool from openvpn as a start

	=== How to use openSUSE CA management instead ===		=== How to use openSUSE CA management instead ===

2014-04-03T16:07:59Z

How to use openSUSE CA management instead

← Older revision		Revision as of 16:07, 3 April 2014
Line 77:		Line 77:
	* yast gui is slower to use		* yast gui is slower to use
	* export of keys only with password, even if key is for a server		* export of keys only with password, even if key is for a server
	* remove passphrase like this		** remove passphrase like this
	openssl rsa -in withpass.key -out withoutpass.key		openssl rsa -in withpass.key -out withoutpass.key
	* openssl commands are intransparent, i.e. no learning curve		* openssl commands are intransparent, i.e. no learning curve
	* more difficult to use for features not implemented in the gui		* more difficult to use for features not implemented in the gui

2014-04-03T16:07:41Z

How to use openSUSE CA management instead

← Older revision		Revision as of 16:07, 3 April 2014
Line 77:		Line 77:
	* yast gui is slower to use		* yast gui is slower to use
	* export of keys only with password, even if key is for a server		* export of keys only with password, even if key is for a server
			* remove passphrase like this
			openssl rsa -in withpass.key -out withoutpass.key
	* openssl commands are intransparent, i.e. no learning curve		* openssl commands are intransparent, i.e. no learning curve
	* more difficult to use for features not implemented in the gui		* more difficult to use for features not implemented in the gui

2014-04-03T16:00:22Z

How to add alternate subjects to certificates

← Older revision		Revision as of 16:00, 3 April 2014
Line 47:		Line 47:

	This is required for an ssl connection (webserver or whatever) to be valid for more than one name (e.g. localhost, job4, job4.job.de, banzhaf.chickenkiller.com)		This is required for an ssl connection (webserver or whatever) to be valid for more than one name (e.g. localhost, job4, job4.job.de, banzhaf.chickenkiller.com)

			Certificates can include extensions. One extension is SubjectAltName.

			SubjectAltName for web- and ldap-server certifiates can hold the valid server names and ip adresses.

			Whether they are honored is client specific, but current browsers and clients using the openldap libs will work (at least if you also include the cn).

			A syntax example for a server:

			SubjectAltName = DNS:banzhaf.chickenkiller.com, DNS:job4.job.de, DNS:job4

			The SubjectAltName needs to be defined in the openssl.conf or in a file given with -extfile

			The openssl.conf should not change all the time. Also if I use env vars for the values, at least the key would be included.
			That's why I'll try using the -extfile option and create the file if necessary.

	=== How to use openSUSE CA management instead ===		=== How to use openSUSE CA management instead ===