Las entidades de certificación (CA) son responsables de emitir certificados digitales para verificar identidades en Internet. Las CA públicas son una opción popular para verificar la identidad de sitios web y otros servicios que se proporcionan al público en general, y las CA privadas suelen usarse para grupos cerrados y servicios privados.
Vamos a montar una CA a mano utilizando openssl
Una maquina con linux y acceso a internet. Claro tambien necesita openssl
$> sudo apt update
$> sudo apt install easy-rsa
En otros (opensuse) me toco simplemente crear el directorio y copiar el ejecutable de easyrsa
$> ./easyrsa init-pki
$> vi vars
set_var EASYRSA_REQ_COUNTRY “CO”
set_var EASYRSA_REQ_PROVINCE “Bogota DC”
set_var EASYRSA_REQ_CITY “Bogota”
set_var EASYRSA_REQ_ORG “SkinaTech”
set_var EASYRSA_REQ_EMAIL “soporte@skinatech.com”
set_var EASYRSA_REQ_OU “SkinaTech CA”
set_var EASYRSA_ALGO “ec”
set_var EASYRSA_DIGEST “sha512”
$> ./easyrsa build-ca nopass
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Generating RSA private key, 2048 bit long modulus (2 primes)
…………………+++++
…+++++
e is 65537 (0x010001)
Can't load /home/kasandra/Documentos/firmas/easy-rsa/pki/.rnd into RNG
139879838134720:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/home/kasandra/Documentos/firmas/easy-rsa/pki/.rnd
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
—–
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:SkinaTech CA
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/home/kasandra/Documentos/firmas/easy-rsa/pki/ca.crt
Esta se identifica por dos archivos ..
Siempre la emision de un certificado pasa por la creacion de un par de llaves publico / privado y una solicitud de firma (CSR) para enviar a la CA para que haga la emision
$> openssl genrsa -out sammy-server.key
$> openssl req -new -key sammy-server.key -out sammy-server.csrSi esta muy pregunton $> openssl req -new -key sammy-server.key -out sammy-server.csr -subj /C=CO/ST=Bogota\\ DC/L=Bogota/O=SkinaTech/OU=SkinaTech\\ CA/CN=sammy-server
Mire si le quedo bien
$> openssl req -in sammy-server.csr -noout -subject
Lo puse en /tmp y de ahi lo incorporo de vuelta en el directorio de easy-rsa
$> ./easyrsa import-req /tmp/sammy-server.req sammy-server
$> ./easyrsa sign-req server sammy-server
Ahi salen todas las caracteristicas y confirmelo con un YES .. y listo
Ahora es solo enviarlo
pki/issued/sammy-server.crt
./easyrsa revoke sammy-server
./easyrsa gen-crl
queda en /pki/crl.pem
Se puede probar con
openssl crl -in pki/crl.pem -noout -text
$> openssl ca -config /etc/openssl.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem -startdate [now] -enddate [previous enddate+365days]
https://tldp.org/HOWTO/SSL-Certificates-HOWTO/x195.html
Generamos el par y el CSR al mismo tiempo
openssl req-new -newkey rsa:2048 -keyout test.key -sha256 -nodes -out test.csr -subj “/CN=test.domain.net” -openssl.cnf
Usando el archivo openssl.cnf con
##Required
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = v3_req
##About the system for the request. Ensure the CN = FQDN
[ req_distinguished_name ]
commonName = test.domain.net
##Extensions to add to a certificate request for how it will be used
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = critical, serverAuth
subjectAltName = @alt_names
##The other names your server may be connected to as
[alt_names]
DNS.1 = test
DNS.2 = test.domain
DNS.3 = testing.domain.net
DNS.4 = 192.168.1.122
- https://www.aemcorp.com/managedservices/blog/creating-digital-certificates-using-openssl
openssl req -new -newkey rsa:2048 -keyout testuser.key -sha256 -nodes -out testuser.csr -subj “/CN=testuser” -config clientopenssl.cnf
Example of a client configuration clientopenssl.cnf:
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = v3_req
##About the user for the request
[ req_distinguished_name ]
commonName = test
##Extensions to add to a certificate request for how it will be used
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = critical, clientAuth
- https://www.aemcorp.com/managedservices/blog/creating-digital-certificates-using-openssl
openssl req -new -newkey rsa:2048 -keyout testsign.key -sha256 -nodes -out testsign.csr -subj “/CN=testsign” -config codesign.cnf
Example of a code signing openssl configuration codesign.cnf:
[ req ]
default_bits = 2048 # RSA key size
encrypt_key = yes # Protect private key
default_md = sha256 # MD to use
utf8 = yes # Input is UTF-8
string_mask = utf8only # Emit UTF-8 strings
prompt = yes # Prompt for DN
distinguished_name = codesign_dn # DN template
req_extensions = codesign_reqext # Desired extensions
[ codesign_dn ]
commonName = $DN
commonName_max = 64
[ codesign_reqext ]
keyUsage = critical,digitalSignature
extendedKeyUsage = critical,codeSigning
subjectKeyIdentifier = hash
- https://www.aemcorp.com/managedservices/blog/creating-digital-certificates-using-openssl
# List all info about the certificate
openssl x509 -in cert.pem -noout -text
# Serial number
openssl x509 -in cert.pem -noout -serial
# Start Date (Not Before)
openssl x509 -in cert.pem -noout -startdate
# End Date (Not After)
openssl x509 -in cert.pem -noout -enddate
# Subject
openssl x509 -in cert.pem -noout -subject
# Subject Alternative Name (SAN)
openssl x509 -in cert.pem -noout -text | grep DNS
# OCSP URI
openssl x509 -in cert.pem -noout -ocsp_uri
ocsp_uri=$(openssl x509 -in cert.pem -noout -ocsp_uri) openssl ocsp -issuer chain.pem -cert cert.pem -url $ocsp_uri -text
https://zzz.buzz/2020/03/11/openssl-commands-for-certificate-management/
openssl verify -untrusted untrusted.pem -CAfile cacert.pem cert.pem
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-using_openssl
-
- Como montarla a mano solo con openssl easy-rsa
- Otra metodologia de montarla a mano con solo openssl
- Otra mas vieja usando un script llamado CA
FIN
15-Marzo-2006 J.E.Gomez v1.0 Primera version
Advertencia
Este documento es privado y es de u so exclusivo de sus autores y de SKINA TECH. Cualquier uso sin una autorización escrita es contra la ley de derechos de autor y de propiedad intelectual, y será motivo de una acción legal.