115 lines
4.7 KiB
Org Mode
115 lines
4.7 KiB
Org Mode
:PROPERTIES:
|
|
:ID: eff86d3a-1ae2-4b92-8c6d-c87c16553253
|
|
:END:
|
|
#+title: self_signed_certificates
|
|
|
|
X.509 is an ITU standard defining the format of public key [[id:e28dfeaa-876b-4255-a25e-dcc0c909d08a][certificates]]. X.509 are used in [[id:872ee33b-8361-40c7-9d88-69b3afe5ade2][TLS]]/[[id:95c8982d-e104-43a2-9bb2-fd7e1c3204f2][SSL]], which is the basis for HTTPS. An X.509 certificate binds an identity to a public key using a digital signature. A certificate contains an identity (hostname, organization, etc.) and a public key (RSA, DSA, ECDSA, ed25519, etc.), and is either signed by a Certificate Authority or is Self-Signed.
|
|
|
|
* Self signed certificates
|
|
Here is how you can generate a self signed certificate
|
|
** generate [[id:89d22755-3547-4b92-8933-c31aa3f9cb12][certificate_authority]] (a Cert without branding)
|
|
|
|
First you need to generate a [[id:23a9283c-0afe-43d6-bc31-2e7bd838b2de][RSA]]
|
|
#+begin_src bash
|
|
openssl genrsa -aes256 -out ca-key.pem 4096
|
|
#+end_src
|
|
|
|
Then a public CA cert has to be gereated
|
|
#+begin_src bash
|
|
openssl req -new -x509 -sha256 -days 365 -key ca-key.pem -out ca.pem
|
|
#+end_src
|
|
|
|
The content of those can be viewed with the commands
|
|
#+begin_src bash
|
|
openssl x509 -in ca.pem -text
|
|
openssl x509 -in ca.pem -purpose -noout -text
|
|
#+end_src
|
|
|
|
** generate the Certificate
|
|
|
|
To generate an actual certificate for your website you also need to generate an RSA Key
|
|
#+begin_src bash
|
|
openssl genrsa -out cert-key.pem 4096
|
|
#+end_src
|
|
|
|
but this time you create a certificate signing request ([[id:f2991e03-0c05-490e-a0d1-dda24c7e58e6][CSR]])
|
|
#+begin_src bash
|
|
openssl req -new -sha256 -subj "/CN=yourcn" -key cert-key.pem -out cert.csr
|
|
#+end_src
|
|
|
|
You then need to create an ~extfile~ with all the elternating names of your domain
|
|
#+begin_src bash
|
|
echo "subjectAltName=DNS:your-dns.record,IP:257.10.10.1" >> extfile.cnf
|
|
#+end_src
|
|
|
|
With that you can then create the actual branded certificate
|
|
#+begin_src bash
|
|
openssl x509 -req -sha256 -days 365 -in cert.csr -CA ca.pem -CAkey ca-key.pem -out cert.pem -extfile extfile.cnf -CAcreateserial
|
|
#+end_src
|
|
|
|
There are different certificate Formats that can be used and those can be converted into each other. X.509 Certificates exist in Base64 Formats PEM (.pem, .crt, .ca-bundle), PKCS#7 (.p7b, p7s) and Binary Formats DER (.der, .cer), PKCS#12 (.pfx, p12).
|
|
*** PEM to DER
|
|
#+begin_src bash
|
|
openssl x509 -outform der -in cert.pem -out cert.der
|
|
#+end_src
|
|
*** DER to PEM
|
|
#+begin_src bash
|
|
openssl x509 -inform der -in cert.der -out cert.pem
|
|
#+end_src
|
|
*** PFX to PEM
|
|
#+begin_src bash
|
|
openssl pkcs12 -in cert.pfx -out cert.pem -nodes
|
|
#+end_src
|
|
|
|
** Validate a Certificate
|
|
To verify a Certificate try the following code:
|
|
#+begin_src bash
|
|
openssl verify -CAfile ca.pem -verbose cert.pem
|
|
#+end_src
|
|
|
|
* Install a CA Cert as a trusted root CA
|
|
For a computer to trust a self signed certificate or a CA the certificate needs to be installed as a trusted root cert on the computer itself. In this way a Self signed cert can be used to secure a self hosted service without using public trusted CA (In an corporal environment or a private [[id:c9461f7b-7368-4b88-b90b-2d785fda2159][subnetwork]] and offline).
|
|
|
|
First move the generated CA certificate (here ~ca.pem~) into [[/usr/local/share/ca-certificates/ca.crt]].
|
|
Then you need to update the cert store:
|
|
|
|
#+begin_src bash
|
|
sudo update-ca-certificates
|
|
#+end_src
|
|
|
|
** On [[id:5fada795-19a3-4ba6-97c0-0b70bd728a2f][Arco-Linux]]
|
|
Here you need to implement it system wide with the following commands:
|
|
#+begin_src bash
|
|
sudo trust anchor --store myCA.crt
|
|
#+end_src
|
|
|
|
The certificate will be written to ~/etc/ca-certificates/trust-source/myCA.p11-kit~ and the "legacy" directories automatically updated.
|
|
If you get "no configured writable location" or a similar error, import the CA manually:
|
|
Copy the certificate to the ~/etc/ca-certificates/trust-source/anchors~ directory.
|
|
and then:
|
|
#+begin_src bash
|
|
sudo update-ca-trust
|
|
#+end_src
|
|
|
|
** On Windows
|
|
Assuming the path to your generated CA certificate as ~C:\ca.pem~, run:
|
|
#+begin_src bash
|
|
Import-Certificate -FilePath "C:\ca.pem" -CertStoreLocation Cert:\LocalMachine\Root
|
|
#+end_src
|
|
|
|
Set ~-CertStoreLocation~ to ~Cert:\CurrentUser\Root~ in case you want to trust certificates only for the logged in user. Or in the command prompt run:
|
|
|
|
#+begin_src bash
|
|
certutil.exe -addstore root C:\ca.pem
|
|
#+end_src
|
|
|
|
** On Android
|
|
The exact steps vary device-to-device, but here is a generalised guide:
|
|
- Open Phone Settings
|
|
- Locate Encryption and Credentials section. It is generally found under ~Settings > Security > Encryption and Credentials~
|
|
- Choose ~Install a certificate~
|
|
- Choose ~CA Certificate~
|
|
- Locate the certificate file ~ca.pem~ on your SD Card/Internal Storage using the file manager.
|
|
- Select to load it.
|
|
- Done!
|