====== Entidad de certificacion a mano ====== ===== Descripción ===== Las entidades de certificación (CA) son responsables de emitir certificados digitales para verificar identidades en Internet. Las CA públicas son una opción popular para verificar la identidad de sitios web y otros servicios que se proporcionan al público en general, y las CA privadas suelen usarse para grupos cerrados y servicios privados.\\ \\ Vamos a montar una CA a mano utilizando openssl\\ ===== Prerequistos ===== Una maquina con linux y acceso a internet. Claro tambien necesita openssl\\ ===== Procedimiento ===== ==== A. Montaje de la CA ==== === 1. Instale el software base  easy-rsa === $> sudo apt update\\ $> sudo apt install easy-rsa\\ \\ En otros (opensuse) me toco simplemente crear el directorio y copiar el ejecutable de easyrsa\\ === 2. Inicialice la estructura de archivos === $> ./easyrsa init-pki === 3. Cree el archivo de variables globales === $> vi vars\\ \\ set_var EASYRSA_REQ_COUNTRY    "CO"\\ set_var EASYRSA_REQ_PROVINCE   "Bogota DC"\\ set_var EASYRSA_REQ_CITY       "Bogota"\\ set_var EASYRSA_REQ_ORG        "SkinaTech"\\ set_var EASYRSA_REQ_EMAIL      "soporte@skinatech.com"\\ set_var EASYRSA_REQ_OU         "SkinaTech CA"\\ set_var EASYRSA_ALGO           "ec"\\ set_var EASYRSA_DIGEST         "sha512"\\ === 4. Construya la CA  (sin password) === $> ./easyrsa build-ca nopass\\ \\ Using SSL: openssl OpenSSL 1.1.1d  10 Sep 2019\\ Generating RSA private key, 2048 bit long modulus (2 primes)\\ .....................+++++\\ ...+++++\\ e is 65537 (0x010001)\\ Can't load /home/kasandra/Documentos/firmas/easy-rsa/pki/.rnd into RNG\\ 139879838134720:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/home/kasandra/Documentos/firmas/easy-rsa/pki/.rnd\\ You are about to be asked to enter information that will be incorporated\\ into your certificate request.\\ What you are about to enter is what is called a Distinguished Name or a DN.\\ There are quite a few fields but you can leave some blank\\ For some fields there will be a default value,\\ If you enter '.', the field will be left blank.\\ -----\\ Common Name (eg: your user, host, or server name) [Easy-RSA CA]:SkinaTech CA\\ \\ CA creation complete and you may now import and sign cert requests.\\ Your new CA certificate file for publishing is at:\\ /home/kasandra/Documentos/firmas/easy-rsa/pki/ca.crt\\ === 5. Su entidad de certificacion esta lista === Esta se identifica por dos archivos .. \\ * pki/ca.cr .. que es el publico que se reparte para el que quiera reconocer la CA * pki/private/ca.key   que es la llave privada de la CA .. CUIDADO CON EALL   ==== B. Emitir un certificado para un cliente ==== Siempre la emision de un certificado pasa por la creacion de un par de llaves  publico / privado y una solicitud de firma (CSR) para enviar a la CA para que haga la emision === 1. Cree el par de llaves === $> openssl genrsa -out sammy-server.key === 2. Cree el CSR === $> openssl req -new -key sammy-server.key -out sammy-server.csrSi esta muy pregunton $> openssl req -new -key sammy-server.key -out sammy-server.csr -subj /C=CO/ST=Bogota\\ DC/L=Bogota/O=SkinaTech/OU=SkinaTech\\ CA/CN=sammy-server Mire si le quedo bien\\ \\ $> openssl req -in sammy-server.csr -noout -subject === 3. Copielo a la CA e incorporelo === Lo puse en /tmp  y de ahi lo incorporo  de vuelta en el directorio de easy-rsa $> ./easyrsa import-req /tmp/sammy-server.req sammy-server === 4. Ahora firmarlo === $> ./easyrsa sign-req server sammy-server\\ \\ Ahi salen todas las caracteristicas y confirmelo con un YES  .. y listo === 5. Ya tiene el certificado === Ahora es solo enviarlo\\ pki/issued/sammy-server.crt   ==== C. Revocar un certificado ==== ./easyrsa revoke sammy-server\\ \\ ==== D. Listado de Certificados revocados (CRLs) ==== ./easyrsa gen-crl queda en  /pki/crl.pem\\ \\ Se puede probar con\\ \\ openssl crl -in pki/crl.pem -noout -text \\ ==== E. Renovar un certificado (vencido) ==== $> openssl ca -config /etc/openssl.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem -startdate [now] -enddate [previous enddate+365days]\\ \\ https:%%//%%tldp.org/HOWTO/SSL-Certificates-HOWTO/x195.html\\ \\ \\   ===== Diferentes Solicitudes ===== ==== A. Un certificado TLS (servidor web) ==== Generamos el par y el CSR al mismo tiempo\\ openssl req-new -newkey rsa:2048 -keyout test.key -sha256 -nodes -out test.csr -subj "/CN=test.domain.net" -openssl.cnf\\ \\ Usando el archivo openssl.cnf con\\ \\ ##Required\\ [ req ]\\ default_bits                                         = 2048\\ distinguished_name                           = req_distinguished_name\\ req_extensions                                   = v3_req\\ \\ ##About the system for the request. Ensure the CN = FQDN\\ [ req_distinguished_name ]\\ commonName                                    = test.domain.net\\ \\ ##Extensions to add to a certificate request for how it will be used\\ [ v3_req ]\\ basicConstraints                                 = CA:FALSE\\ keyUsage                                           = critical, nonRepudiation, digitalSignature, keyEncipherment\\ extendedKeyUsage                            = critical, serverAuth\\ subjectAltName                                  = @alt_names\\ \\ ##The other names your server may be connected to as\\ [alt_names]\\ DNS.1                                                 = test\\ DNS.2                                                 = test.domain\\ DNS.3                                                 = testing.domain.net\\ DNS.4                                                 = 192.168.1.122\\ \\ - https:%%//%%www.aemcorp.com/managedservices/blog/creating-digital-certificates-using-openssl\\   ==== B. Un certificado de un cliente (persona) ==== openssl req -new -newkey rsa:2048 -keyout testuser.key -sha256 -nodes -out testuser.csr -subj "/CN=testuser" -config clientopenssl.cnf\\ \\ Example of a client configuration clientopenssl.cnf:\\ \\ [ req ]\\ default_bits                                                    = 2048\\ distinguished_name                                      = req_distinguished_name\\ req_extensions                                              = v3_req\\ \\ ##About the user for the request\\ [ req_distinguished_name ]\\ commonName                                               = test\\ \\ ##Extensions to add to a certificate request for how it will be used\\ [ v3_req ]\\ basicConstraints                                            = CA:FALSE\\ keyUsage                                                       = critical, nonRepudiation, digitalSignature, keyEncipherment\\ extendedKeyUsage                                       = critical, clientAuth\\ \\ - https:%%//%%www.aemcorp.com/managedservices/blog/creating-digital-certificates-using-openssl\\   ==== C. Un Certificado para firmar codigo ==== openssl req -new -newkey rsa:2048 -keyout testsign.key -sha256 -nodes -out testsign.csr -subj "/CN=testsign" -config codesign.cnf\\ \\ Example of a code signing openssl configuration codesign.cnf:\\ \\ [ req ]\\ default_bits                     = 2048                            # RSA key size\\ encrypt_key                    = yes                               # Protect private key\\ default_md                      = sha256                        # MD to use\\ utf8                                  = yes                              # Input is UTF-8\\ string_mask                     = utf8only                       # Emit UTF-8 strings\\ prompt                             = yes                              # Prompt for DN\\ distinguished_name        = codesign_dn               # DN template\\ req_extensions               = codesign_reqext          # Desired extensions\\ \\ [ codesign_dn ]\\ commonName                = $DN\\ commonName_max       = 64\\ \\ [ codesign_reqext ]\\ keyUsage                       = critical,digitalSignature\\ extendedKeyUsage        = critical,codeSigning\\ subjectKeyIdentifier        = hash\\  \\ - https:%%//%%www.aemcorp.com/managedservices/blog/creating-digital-certificates-using-openssl\\     ===== Inspeccionar un certificado ===== ==== A. Lo que cuenta el certifficado ==== # List all info about the certificate\\ openssl x509 -in cert.pem -noout -text\\ \\ # Serial number\\ openssl x509 -in cert.pem -noout -serial\\ \\ # Start Date (Not Before)\\ openssl x509 -in cert.pem -noout -startdate\\ \\ # End Date (Not After)\\ openssl x509 -in cert.pem -noout -enddate\\ \\ # Subject\\ openssl x509 -in cert.pem -noout -subject\\ \\ # Subject Alternative Name (SAN)\\ openssl x509 -in cert.pem -noout -text | grep DNS\\ \\ # OCSP URI\\ openssl x509 -in cert.pem -noout -ocsp_uri\\ \\   ==== B. Chequear el OCSP si es valido ==== ocsp_uri=$(openssl x509 -in cert.pem -noout -ocsp_uri) openssl ocsp -issuer chain.pem -cert cert.pem -url $ocsp_uri -text \\ https:%%//%%zzz.buzz/2020/03/11/openssl-commands-for-certificate-management/\\ \\ ==== C. Verificar la cadena de confianza de un  certificado cert.pem y el untrusted es una CA intermedia ==== openssl verify -untrusted untrusted.pem -CAfile cacert.pem cert.pem \\ https:%%//%%access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-using_openssl\\ \\   ===== Problemas ===== ==== 1. Si el instale_mrtg.sh no le funciona ==== - ===== Referencias ===== - [[https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-a-certificate-authority-ca-on-ubuntu-20-04-es|Como montarla a mano solo con openssl easy-rsa]]   \\ - [[https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html|Otra metodologia de montarla a mano con solo openssl]]  \\ - [[https://tldp.org/HOWTO/SSL-Certificates-HOWTO/x195.html|Otra mas vieja usando un script llamado CA]]    \\ \\ \\ FIN ============================================================== 15-Marzo-2006 J.E.Gomez v1.0 Primera version ---- __**Advertencia**__ Este documento es privado y es de u so exclusivo de sus autores y de SKINA TECH. Cualquier uso sin una autorización escrita es contra la ley de derechos de autor y de propiedad intelectual, y será motivo de una acción legal. ----