SSL server

Revision as of 15:26, 25 May 2014 by WikiFreak (talk | contribs)

SSL: Cryptography & authentication



Principle and law disclaimer

Reminder An Authority of Certification is required to ensure your certificates. Theses one provides:

  • Confidentiality
  • Integrity
  • Authentication


There's three options:

  • You can create your own Authority of Certification ;
  • Use a trusted Authority of Certification (commercial). Unfortunately, it's very expansive to use such ones ;
  • Use an Open Source Authority of Certification: www.cacert.org


Legal aspects

You are not allowed to use any cryptography. The maximum cryptographic level is set by the law.

Region Law
France http://www.ssi.gouv.fr/fr/reglementation-ssi/cryptologie/tableau-de-synthese-de-reglementation-en-matiere-de-cryptologie.html
Sweden to be done
European Union to be done



Installation

Install packages

apt-get install openssl


Prep folders

Create working directory

mkdir -p /srv/ssl
cd /srv/ssl


Create ssl structure

mkdir certs crl newcerts private export


Initialize values

echo 01 > serial
touch index.txt
cp /usr/lib/ssl/openssl.cnf .



OpenSSL root configuration

During the process you’ll have to enter the same data many times:

>> You should edit the default values


Adjust default values

Edit openssl.cnf: 

vim /srv/ssl/openssl.cnf

Set the working directory: 

dir = /srv/ssl                            # Where everything is kept  [line 42]

[ req_distinguished_name ]
countryName_default             = SE                        # [line 128]   
stateOrProvinceName_default     = Västra Götaland           # [line 134]
localityName_default            = Goteborg                  # [line 137]
0.organizationName_default      = Daxiongmao.eu             # [line 140]
emailAddress_default            = guillaume@qin-diaz.com    # [line 154]



Authority of Certification (CA)

Difference between local AC / commercial AC

Either you create your own Authority of Certification or you can use a commercial one.

Main differences:

Personal AC Commercial AC
Price free from 50$ / year (Go Daddy)
Validity you choose Usually 1 or 2 year
Browser alerts Yes No
Can be used for e-commerce No Yes
  • July 2013: "Go Daddy" seems to be the cheapest authority.


Choose an authority of certification and subscribe to a wildcard domain certification.


In either case you need to:

  • Create a private key
  • Generate a request (that will slightly change)


Create CA private key

Generate a RSA private key (4096 bits length) for the CA and protect it with AES256 encryption. 

openssl genrsa -aes256 -out private/cakey.pem -rand ./ 4096

You have to enter a password.

!! This password will be required to perform all next operations


Create a personal CA [or Domain root certificate]

Auto-sign your Certification Authority for 10 years 

openssl req -config openssl.cnf \
-new -x509 -sha256 -nodes \
-key private/cakey.pem \
-out cacerts.pem \
-days 3600


Answer the questions:

  • Country Name (2 letter code) [SE]:
  • State or Province Name (full name) [Västra Götaland]:
  • Locality Name (eg, city) [Göteborg]:
  • Organization Name (eg, company) [Daxiongmao.eu]:
  • Organizational Unit Name (eg, section) []:
  • Common Name (e.g. server FQDN or YOUR name) []: Daxiongmao.eu CA
  • Email Address [guillaume@qin-diaz.com]:


Some explanations:

Header text Header text
Parameter meaning
-config openssl.cnf to use the local OpenSSL configuration file
-new to request a new certificate
-x509 auto-sign this certificate
-sha256 hash algorithm to use
-key certificate private key
-out Target output file to create
-days Certificate validity time (in days)


You can check result by: 

openssl x509 -in cacerts.pem -text -noout


[Alternative]] Request for a domain root certificate

Create a new server certificate request for target CA.

  • See process below to generate server’s certificate requestServer certificate



Server certificate

Go to the working directory: 

cd /srv/ssl


Create server private key

Generate encrypt private key

openssl genrsa -aes256 -out private/serverName.key -rand ./ 4096

ServerName must match the server FQDN.


Ex: dev.daxiongmao.eu 

openssl genrsa -aes256 -out private/dev.daxiongmao.eu.key -rand ./ 4096


Decipher private key

If your key is encrypted, then you have to manually give the password each and every time a service starts.


!! If your private key is encrypt then it cannot be used at startup !!


So, for services like Apache2, you have to decipher the key: 

openssl rsa -in private/serverName.key -out private/serverName.nopass.key


Create server’s certificate request

openssl req -config openssl.cnf \
-new -nodes \
-key private/serverName.key \
-out certs/serverName.req

Answer the questions:

  • Country Name (2 letter code) [SE]:
  • State or Province Name (full name) [Västra Götaland]:
  • Locality Name (eg, city) [Göteborg]:
  • Organization Name (eg, company) [Daxiongmao.eu]:
  • Organizational Unit Name (eg, section) []:
  • Common Name (e.g. server FQDN or YOUR name) []: dev.daxiongmao.eu
  • Email Address [guillaume@qin-diaz.com]:


!! Do not use a challenge password !!


1 st option: sign the request with your own CA

  1. openssl ca -config openssl.cnf \

-in certs/serverName.req \ -out certs/serverName.cert.pem \ -cert cacerts.pem \ -days 3600Some explanations: Parameter meaning -config openssl.cnf to use the local OpenSSL configuration file -in Incoming certificate request -out Target certificate file -cert CA certificate to use -days Certificate validity time (in days) You can check result by:

  1. cat /srv/ssl/certs/serverName.cert.pem

2 nd option: send the request to the CA You have to send the “.req” file to the CA. They will send you back the certificate.Export certificate – PKCS12

  1. cd /srv/ssl

To export a certificate, it must be in PKCS12 format.  You have to perform the following for each and every certificate you’d like to export.

  1. openssl pkcs12 -export \

-descert -inkey private/serverName.key \ -in certs/serverName.cert.pem \ -certfile cacerts.pem \ -name "Certicate name" \ -out export/serverName.p12  Do not put an export password.  You can also use the non-protected keySetup website to send local CA and server certificates This required to have a web server up and running Create dedicated folder

  1. mkdir -p /var/www/ssl/certs
  2. touch /var/www/ssl/certs/index.html

Web page <html> <head> <title>Certificates list</title> </head> <body>

Certificates list

Certification Authority

Authority of certification: <a href="https://serverURL/certs/cacerts.pem ">root certificate</a>

Servers certificates

Click on the following links to download sub-servers certificates

</body> </html> Copy files

  1. cp /srv/ssl/cacerts.pem /var/www/ssl/certs/cacerts.pem
  2. cp /srv/ssl/ export/serverName.p12 /var/www/ssl/certs/serverName.p12

Update rights

  1. chown -R www-data:www-data /var/www/ssl
  2. chmod 755 -R /var/www/sslInstallation on client computer

Go to https://myServer/certs 1 st alert You haven’t install the certificate yet... This website is presume to be non-secured. Example of alert on Google chrome (click “proceed anyway”) Then, you will see the following alert on URL: Download file Save file Installation Go to Google Chrome > Settings > Show advanced settings >   Enable “check for server certificate revocation” Click on manage certificates... Certification Authority Click on “Trusted root Certification Authorities” > Import...Choose the file to import (myCA.pem)  .pem are not displayed by default, but they can be used  Trust the certificates Restart Google Chrome Check result After Google Chrome restart, go back to https://myServer/certs Everything is OK now!

Retrieved from "http://www.daxiongmao.eu/wiki/index.php?title=SSL_server&oldid=341"