siteadmin:client_certificate_pki_configuration
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| siteadmin:client_certificate_pki_configuration [2021/05/07 08:50] – [Client Certificate PKI Configuration] admin | siteadmin:client_certificate_pki_configuration [2021/05/07 09:20] (current) – admin | ||
|---|---|---|---|
| Line 13: | Line 13: | ||
| The approach here is going to be simple. A Root CA with a single certificate and using eapol_test to test. | The approach here is going to be simple. A Root CA with a single certificate and using eapol_test to test. | ||
| - | openssl.conf | + | openssl.conf: |
| < | < | ||
| Line 131: | Line 131: | ||
| </ | </ | ||
| - | and xpextensions | + | The defaults need changing, as do the crlDistributionPoints. The config has been adapted to many things over years so is far from optimal. There will be stuff that's unnecessary |
| + | |||
| + | xpextensions: | ||
| < | < | ||
| Line 143: | Line 145: | ||
| =====The Root CA===== | =====The Root CA===== | ||
| + | First, generate the certificate: | ||
| + | < | ||
| + | openssl req -new -x509 -extensions v3_ca -keyout private/ | ||
| + | </ | ||
| + | |||
| + | Remember the password, you'll need it later for the client cert. | ||
| + | |||
| + | Then, convert it to a PCKS12 file: | ||
| + | |||
| + | < | ||
| + | openssl pkcs12 -export -out cacert.pfx -inkey private/ | ||
| + | |||
| + | </ | ||
| + | |||
| + | Example: | ||
| + | |||
| + | < | ||
| + | Certificate: | ||
| + | Data: | ||
| + | Version: 3 (0x2) | ||
| + | Serial Number: | ||
| + | 1f: | ||
| + | Signature Algorithm: sha256WithRSAEncryption | ||
| + | Issuer: C = GB, ST = England, L = Manchester, O = Scarfolk, OU = Scarfolk, emailAddress = mike.richardson@jisc.ac.uk | ||
| + | Validity | ||
| + | Not Before: May 4 13:15:23 2021 GMT | ||
| + | Not After : Apr 10 13:15:23 2121 GMT | ||
| + | Subject: C = GB, ST = England, L = Manchester, O = Scarfolk, OU = Scarfolk, emailAddress = mike.richardson@jisc.ac.uk | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | RSA Public-Key: (2048 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | 33: | ||
| + | 67: | ||
| + | 03: | ||
| + | bf: | ||
| + | 33: | ||
| + | 1c: | ||
| + | 34: | ||
| + | f8: | ||
| + | 61: | ||
| + | 05: | ||
| + | 6a: | ||
| + | e8: | ||
| + | 25: | ||
| + | 33: | ||
| + | 52: | ||
| + | 68: | ||
| + | 7f:4f | ||
| + | Exponent: 65537 (0x10001) | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:TRUE | ||
| + | X509v3 Subject Key Identifier: | ||
| + | 7B: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | DirName:/ | ||
| + | serial: | ||
| + | |||
| + | X509v3 CRL Distribution Points: | ||
| + | |||
| + | Full Name: | ||
| + | URI: | ||
| + | |||
| + | Signature Algorithm: sha256WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | </ | ||
| + | |||
| + | =====The Client Certificate===== | ||
| + | |||
| + | First, the CSR: | ||
| + | |||
| + | < | ||
| + | openssl req -new -nodes -reqexts client -out newclients/ | ||
| + | </ | ||
| + | |||
| + | It will prompt for a number of fields. The key one is the hostname. It must be set to the username@realm needed. The realm will be used in the outer ID so should be in the right format for routing. The username part is mostly irrelevant, unless used at other points for authorisation. | ||
| + | |||
| + | Then the cert is signed against the CA: | ||
| + | |||
| + | < | ||
| + | openssl ca -out newclients/ | ||
| + | </ | ||
| + | |||
| + | Convert the certificate to PKCS12: | ||
| + | |||
| + | < | ||
| + | openssl pkcs12 -export -out newclients/ | ||
| + | </ | ||
| + | |||
| + | And you're done. | ||
| + | |||
| + | Example: | ||
| + | |||
| + | < | ||
| + | Certificate: | ||
| + | Data: | ||
| + | Version: 3 (0x2) | ||
| + | Serial Number: 7 (0x7) | ||
| + | Signature Algorithm: sha256WithRSAEncryption | ||
| + | Issuer: C = GB, ST = England, L = Manchester, O = Scarfolk, OU = Scarfolk, emailAddress = mike.richardson@jisc.ac.uk | ||
| + | Validity | ||
| + | Not Before: May 6 13:35:02 2021 GMT | ||
| + | Not After : May 8 13:35:02 2121 GMT | ||
| + | Subject: C = GB, ST = England, L = Manchester, O = Scarfolk, OU = Scarfolk, CN = staff@fr.fr.scarfolk.local | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | RSA Public-Key: (2048 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | 60: | ||
| + | 8f: | ||
| + | 25: | ||
| + | 8e: | ||
| + | e1: | ||
| + | 6f: | ||
| + | aa: | ||
| + | 9b: | ||
| + | 8b: | ||
| + | 4f: | ||
| + | 24: | ||
| + | 48: | ||
| + | 1e: | ||
| + | 65: | ||
| + | 74: | ||
| + | 49: | ||
| + | 83:11 | ||
| + | Exponent: 65537 (0x10001) | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:FALSE | ||
| + | Netscape Cert Type: | ||
| + | SSL Client, SSL Server, S/MIME | ||
| + | Netscape Comment: | ||
| + | OpenSSL Generated Client Certificate | ||
| + | X509v3 Subject Key Identifier: | ||
| + | B8: | ||
| + | X509v3 Key Usage: critical | ||
| + | Digital Signature, Non Repudiation, | ||
| + | X509v3 Extended Key Usage: | ||
| + | TLS Web Server Authentication, | ||
| + | X509v3 CRL Distribution Points: | ||
| + | |||
| + | Full Name: | ||
| + | URI: | ||
| + | |||
| + | Signature Algorithm: sha256WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | </ | ||
siteadmin/client_certificate_pki_configuration.1620377424.txt.gz · Last modified: 2021/05/07 08:50 by admin