User Tools

Site Tools


brokers:certificates

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
brokers:certificates [2016/05/02 08:53]
buben [Client certificates]
brokers:certificates [2016/05/09 10:24] (current)
Line 1: Line 1:
 +====== Certificates ======
  
 +To establish an encrypted connection, we need an encryption key. We also needs some third party authority which verifies, that encryption key belongs to authorized user.
 +
 +In another words, to establish connection we have to create encryption key for both server and client, create certificate authority ([[https://​en.wikipedia.org/​wiki/​Certificate_authority|CA]]) to sign keys and create certification requests. This is generally done using openssl library tool with the same name – openssl. But create all these things with openssl command requires lot of commands with many parameters. For that reason [[https://​openvpn.net/​index.php/​open-source/​documentation/​miscellaneous/​77-rsa-key-management.html|EasyRSA]] was created, which simplifies this procedure.
 +
 +Following steps should be done on some secured system dedicated for storing CA and key signing. It is recommended to keep this computer in locked room and completely disconnected from the network. For purpose of this article, I create all files in my ''/​tmp''​ directory.
 +
 +===== EasyRSA =====
 +First of all download [[https://​github.com/​OpenVPN/​easy-rsa|EasyRSA]] from GitHub:
 +
 +<​code>​
 +$ git clone https://​github.com/​OpenVPN/​easy-rsa
 +</​code>​
 +
 +Next, change working directory and create configuration file:
 +
 +<​code>​
 +$ cd easy-rsa/​easyrsa3
 +easy-rsa/​easyrsa3$ cp vars.example vars
 +easy-rsa/​easyrsa3$ nano vars
 +</​code>​
 +
 +Now edit configuration values. Most important are following variables:
 +
 +<​code>​
 +#set_var EASYRSA_REQ_COUNTRY ​    "​US"​
 +#set_var EASYRSA_REQ_PROVINCE ​   "​California"​
 +#set_var EASYRSA_REQ_CITY ​       "San Francisco"​
 +#set_var EASYRSA_REQ_ORG "​Copyleft Certificate Co"
 +#set_var EASYRSA_REQ_EMAIL ​      "​me@example.net"​
 +#set_var EASYRSA_REQ_OU ​         "My Organizational Unit"
 +</​code>​
 +
 +Just uncomment them and assign them appropriate literals. If you want to omit some of these values (such as  ''​EASYRSA_REQ_OU''​) fill it with ''​.''​ (dot).
 +
 +After EasyRSA is configured, you can initialize [[https://​en.wikipedia.org/​wiki/​Public_key_infrastructure|public key infrastructure]] (PKI):
 +
 +<​code>​
 +easy-rsa/​easyrsa3$ ./easyrsa init-pki
 +</​code>​
 +
 +After that, empty pki should look like this:
 +
 +<​code>​
 +easy-rsa/​easyrsa3$ tree pki/
 +pki/
 +├── private
 +└── reqs
 +</​code>​
 +
 +===== Generate CA =====
 +First this what have to be created is CA.
 +
 +<​code>​
 +easy-rsa/​easyrsa3$ ./easyrsa build-ca
 +
 +Note: using Easy-RSA configuration from: ./vars
 +Generating a 2048 bit RSA private key
 +...................................................+++
 +..+++
 +writing new private key to '/​tmp/​easy-rsa/​easyrsa3/​pki/​private/​ca.key.EYi53CVs1x'​
 +Enter PEM pass phrase:
 +Verifying - Enter PEM pass phrase:
 +-----
 +You are about to be asked to enter information that will be incorporated
 +into your certificate request.
 +What you are about to enter is what is called a Distinguished Name or a DN.
 +There are quite a few fields but you can leave some blank
 +For some fields there will be a default value,
 +If you enter '​.',​ the field will be left blank.
 +-----
 +Common Name (eg: your user, host, or server name) [Easy-RSA CA]:my-ca
 +
 +CA creation complete and you may now import and sign cert requests.
 +Your new CA certificate file for publishing is at:
 +/​tmp/​easy-rsa/​easyrsa3/​pki/​ca.crt
 +</​code>​
 +
 +Command build-ca creates CA files encrypted with pass phrase. You can append nopass argument to create plaintext CA. I recommend you to protect it. Command also asks for common name. It should be some meaningful string, as the prompt suggests.
 +===== Server side =====
 +Next, create server key and certificate request file:
 +
 +<​code>​
 +easy-rsa/​easyrsa3$ ./easyrsa gen-req server-cert nopass
 +
 +Note: using Easy-RSA configuration from: ./vars
 +Generating a 2048 bit RSA private key
 +..+++
 +............+++
 +writing new private key to '/​tmp/​easy-rsa/​easyrsa3/​pki/​private/​server-cert.key.LlGDzHp1hN'​
 +-----
 +You are about to be asked to enter information that will be incorporated
 +into your certificate request.
 +What you are about to enter is what is called a Distinguished Name or a DN.
 +There are quite a few fields but you can leave some blank
 +For some fields there will be a default value,
 +If you enter '​.',​ the field will be left blank.
 +-----
 +Common Name (eg: your user, host, or server name) [server-cert]:​
 +
 +Keypair and certificate request completed. Your files are:
 +req: /​tmp/​easy-rsa/​easyrsa3/​pki/​reqs/​server-cert.req
 +key: /​tmp/​easy-rsa/​easyrsa3/​pki/​private/​server-cert.key
 +</​code>​
 +
 +In this case I recommend you to use nopass argument. Otherwise you will have to manually type a pass phrase every time you want to start a VPN server, which is nonsence.
 +
 +Command again asks for common name. In case of server key, it must match the server hostname. This is the way how the client verifies that it is authenticating with correct machine. If common name doesn'​t match to server hostname, certificate verification fails.
 +
 +Next, sign server request with your CA:
 +
 +<​code>​
 +easy-rsa/​easyrsa3$ ./easyrsa sign-req server server-cert
 +
 +Note: using Easy-RSA configuration from: ./vars
 +
 +
 +You are about to sign the following certificate.
 +Please check over the details shown below for accuracy. Note that this request
 +has not been cryptographically verified. Please be sure it came from a trusted
 +source or that you have verified the request checksum with the sender.
 +
 +Request subject, to be signed as a server certificate for 3650 days:
 +
 +subject=
 +    commonName ​               = server-cert
 +
 +
 +Type the word '​yes'​ to continue, or any other input to abort.
 +  Confirm request details: yes
 +Using configuration from /​tmp/​easy-rsa/​easyrsa3/​openssl-1.0.cnf
 +Enter pass phrase for /​tmp/​easy-rsa/​easyrsa3/​pki/​private/​ca.key:​
 +Check that the request matches the signature
 +Signature ok
 +The Subject'​s Distinguished Name is as follows
 +commonName ​           :ASN.1 12:'​server-cert'​
 +Certificate is to be certified until Apr 30 08:39:15 2026 GMT (3650 days)
 +
 +Write out database with 1 new entries
 +Data Base Updated
 +
 +Certificate created at: /​tmp/​easy-rsa/​easyrsa3/​pki/​issued/​server-cert.crt
 +</​code>​
 +
 +If CA is encrypted, command asks for its pass phrase.
 +
 +==== Diffie-Hellman ====
 +Last step is create [[https://​wiki.openssl.org/​index.php/​Diffie_Hellman|Diffie-Hellman]] parameters for initial key exchange:
 +
 +<​code>​
 +easy-rsa/​easyrsa3$ ./easyrsa gen-dh
 + 
 +Note: using Easy-RSA configuration from: ./vars
 +Generating DH parameters, 2048 bit long safe prime, generator 2
 +This is going to take a long time
 +........................... [ … snip … ] ........++*++*
 + 
 +DH parameters of size 2048 created at /​tmp/​easy-rsa/​easyrsa3/​pki/​dh.pem
 +</​code>​
 +
 +
 +===== Client side =====
 +
 +Generating client side certificates is very similar to generating server side one. Generating certificate request is exactly same:
 +
 +<​code>​
 +easy-rsa/​easyrsa3$ ./easyrsa gen-req client-cert nopass
 +
 +Note: using Easy-RSA configuration from: ./vars
 +Generating a 2048 bit RSA private key
 +........................+++
 +..........................................+++
 +writing new private key to '/​tmp/​easy-rsa/​easyrsa3/​pki/​private/​client-cert.key.VXHcRiIzab'​
 +-----
 +You are about to be asked to enter information that will be incorporated
 +into your certificate request.
 +What you are about to enter is what is called a Distinguished Name or a DN.
 +There are quite a few fields but you can leave some blank
 +For some fields there will be a default value,
 +If you enter '​.',​ the field will be left blank.
 +-----
 +Common Name (eg: your user, host, or server name) [client-cert]:​
 +
 +Keypair and certificate request completed. Your files are:
 +req: /​tmp/​easy-rsa/​easyrsa3/​pki/​reqs/​client-cert.req
 +key: /​tmp/​easy-rsa/​easyrsa3/​pki/​private/​client-cert.key
 +</​code>​
 +
 +Sign certificate request of client type by following command:
 +
 +<​code>​
 +easy-rsa/​easyrsa3$ ./easyrsa sign-req client client-cert
 +
 +Note: using Easy-RSA configuration from: ./vars
 +
 +
 +You are about to sign the following certificate.
 +Please check over the details shown below for accuracy. Note that this request
 +has not been cryptographically verified. Please be sure it came from a trusted
 +source or that you have verified the request checksum with the sender.
 +
 +Request subject, to be signed as a client certificate for 3650 days:
 +
 +subject=
 +    commonName ​               = client-cert
 +
 +
 +Type the word '​yes'​ to continue, or any other input to abort.
 +  Confirm request details: yes
 +Using configuration from /​tmp/​easy-rsa/​easyrsa3/​openssl-1.0.cnf
 +Enter pass phrase for /​tmp/​easy-rsa/​easyrsa3/​pki/​private/​ca.key:​
 +Check that the request matches the signature
 +Signature ok
 +The Subject'​s Distinguished Name is as follows
 +commonName ​           :ASN.1 12:'​client-cert'​
 +Certificate is to be certified until Apr 30 08:40:49 2026 GMT (3650 days)
 +
 +Write out database with 1 new entries
 +Data Base Updated
 +
 +Certificate created at: /​tmp/​easy-rsa/​easyrsa3/​pki/​issued/​client-cert.crt
 +</​code>​
brokers/certificates.txt · Last modified: 2016/05/09 10:24 (external edit)