Difference between revisions of "OpenSSL"
m (typo) |
(writerand) |
||
Line 97: | Line 97: | ||
The file <i>www.mydomain.com.csr</i> can be provided to the certificate authority for signing. | The file <i>www.mydomain.com.csr</i> can be provided to the certificate authority for signing. | ||
== Writing random seed with writerand == | |||
Sometimes openssl lacks a random seed and fails. You can easily create a file for this. | |||
<pre>$ openssl rand -writerand $HOME/.rnd</pre> |
Revision as of 14:03, 21 September 2022
OpenSSLis the widely used encryption layer in UNIX operating systems. The most common day to day use is providing transport layer security to websites, such as this one and indicated by the use of https in the URL.
Points to be covered in this document
- Generating a private key
- Generating a Certificate Signing Request
- Fitting an SSL key
- Verification
- Starting a Certificate Authority.
Will be fleshed out as time allows.
Creating and using S/MIME
This is how to create a self-signed S/MIME certificate, used for email encryption and decryption in an email client.
First, generate your new key for the sender:
$ openssl genrsa -out smime.key 2048
Then create a Certificate Signing Request:
$ openssl req -new -key smime.key -out smime.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:GB State or Province Name (full name) [Some-State]:Leeds Locality Name (eg, city) []:Leeds Organization Name (eg, company) [Internet Widgits Pty Ltd]:Palfreman Trading Ltd Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:William Palfreman Email Address []:william@palfreman.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
Then sign the CSR using your own Certificate Authority.
$ openssl x509 -req -days 730 -in csr/smime.csr -CA certs/intermediate.crt -CAkey private/intermediate.key -set_serial 1 -out ../smime/smime.crt
Then the receiver needs to create a key and a certificate signing request. This is their server.
$ openssl genrsa -out sender-smime.key 2048 Generating RSA private key, 2048 bit long modulus (2 primes) ........................................................................................+++++ ........+++++ Then create the Certificate Request using the new key <pre> $ openssl req -new -key sender-smime.key -out sender-smime.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:GB State or Province Name (full name) [Some-State]:London Locality Name (eg, city) []:LONDON Organization Name (eg, company) [Internet Widgits Pty Ltd]:University of Grantchester Organizational Unit Name (eg, section) []:Grantchester HostCo Common Name (e.g. server FQDN or YOUR name) []:William Palfreman Email Address []:william.palfreman@grantchester.ac.uk Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
The creates a certificate request (CSR) which isn't confidential but I won't list here. Take that CSR to your Certificate Authority (CA) and issue the certificate
$ openssl x509 -req -days 365 -in csr/grant.csr -CA certs/intermediate.crt -CAkey private/intermediate.key -out grant.crt Certificate request self-signature ok subject=C = GB, ST = London, L = LONDON, O = University of Granchester, OU = HostCo, CN = William Palfreman, emailAddress = william.palfreman@grantchester.ac.uk Enter pass phrase for private/intermediate.key:
Then pass the receiver sender certificate back to the sending server.
[Next, details about the openssl pipeline to sign and encrypt the smime attachment.]
Keys and CSRs for websites
Create Key
Create the new RSA key. This should be done for each new certificate and should remain on the server it is intended for.
$ openssl genrsa -out www.mydomain.com.key 2048 $ chmod 400 www.mydomain.com.key
Create CSR
- Make a local copy of openssl.cnf
- Uncomment the line about v3_extensions
req_extensions = v3_req
- Add a subjectAltName under basicConstraints and keyUsage
basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = DNS:www.mydomain.com,DNS:mydomain.com,DNS:other.mydomain.com
There is some debate whether wildcard domains can be SANs. I think they can.
Now create the CSR for the website.
$ openssl req -new -key www.mydomain.com.key -sha256 -config openssl.cnf -subj '/C=GB/ST=Yorkshire/L=Leeds/O=Company Name/OU=Company IT Dept/CN=www.mydomain.com' > www.mydomain.com.csr
The file www.mydomain.com.csr can be provided to the certificate authority for signing.
Writing random seed with writerand
Sometimes openssl lacks a random seed and fails. You can easily create a file for this.
$ openssl rand -writerand $HOME/.rnd