CA - Revision history

Jaroslov at 13:50, 11 April 2012

2012-04-11T13:50:57Z

2012-04-11T13:46:53Z

2011-11-06T01:28:48Z

2011-11-06T01:17:04Z

‎Sign server cert

2011-11-06T01:15:08Z

‎0x20 CA

2011-11-06T01:14:41Z

2011-11-06T00:58:17Z

‎Create a CA

2011-11-06T00:57:06Z

‎0x20 CA

2011-11-05T23:38:15Z

Created page with "== 0x20 CA == * Used for OpenVPN ."

New page

== 0x20 CA ==
* Used for [[OpenVPN]] .

@@ Line 57: / Line 57: @@
 $ openssl ca -in 0x20-client.csr -cert ca-0x20-cert.pem -keyfile \
   private/ca-0x20-key.pem -out 0x20-client.cert -config ./openssl.cnf
 </pre>

@@ Line 45: / Line 45: @@
 </pre>
 * check index.txt (= the CA db)
 == Create a CRL ==

@@ Line 5: / Line 5: @@
 |Short description=0x20 Certificate Authority CA
 }}
+= 0x20 Certificate Authority =
-= 0x20 CA =
 * CA with OpenSSL
 ** all flat files in 1 directory

@@ Line 38: / Line 38: @@
 <pre>
 $ openssl genrsa -aes256 -out 0x20-servername.key 2048
-$ openssl req -new -key 0x20-servername.key -nodes -out 0x20-members-vpn.csr
+$ openssl req -new -key 0x20-servername.key -nodes -out 0x20-servername.csr
 </pre>
 * Sign the certificate:
 <pre>
-$ openssl ca -in 0x20-members-vpn-req.pem -cert ca-0x20-cert.pem -keyfile \
+$ openssl ca -in 0x20-servername.csr -cert ca-0x20-cert.pem -keyfile \
-  private/ca-0x20-key.pem -out 0x20-members-vpn.cert -config ./openssl.cnf
+  private/ca-0x20-key.pem -out 0x20-servername.cert -config ./openssl.cnf
 </pre>
 * check index.txt (= the CA db)

@@ Line 9: / Line 9: @@
 * CA with OpenSSL
 ** all flat files in 1 directory
-** can easily be transported on an encrypted filesystem
+** can easily be stored/transported on an encrypted filesystem
 * Used for [[OpenVPN]] authentication

@@ Line 1: / Line 1: @@
 = 0x20 CA =
 * CA with OpenSSL
@@ Line 20: / Line 27: @@
 private/ca-0x20-key.pem -out ca-0x20-cert.pem -config ./openssl.cnf
 </pre>

@@ Line 16: / Line 16: @@
 == Create a CA ==
 * based on http://www.freebsdmadeeasy.com/tutorials/freebsd/create-a-ca-with-openssl.php
- $ openssl req -new -x509 -days 5475 -newkey rsa:4096 -extensions v3_ca -keyout private/ca-0x20-key.pem -out ca-0x20-cert.pem -config ./openssl.cnf
+<pre>

← Older revision		Revision as of 00:57, 6 November 2011
Line 1:		Line 1:
−	== 0x20 CA ==	+	= 0x20 CA =
−	* Used for [[OpenVPN]] .	+	* CA with OpenSSL
		+	** all flat files in 1 directory
		+	** can easily be transported on an encrypted filesystem
		+	* Used for [[OpenVPN]] authentication
		+
		+	== openssl.cnf ==
		+	Check the openssl.cnf file with the 0x20 specific values:
		+	* root ca is valid for 15 years
		+	* certificates are valid for 5 years
		+	* DN: C=BE, ST=Ghent, L=Whitespace, O=0x20, CN=0x20 root ca
		+	* nsCaRevocationUrl = http://www.0x20.be/ca-0x20-crl.pem
		+	* extendedKeyUsage=serverAuth (server certs)
		+	* extendedKeyUsage=clientAuth (client certs)
		+
		+	== Create a CA ==
		+	* based on http://www.freebsdmadeeasy.com/tutorials/freebsd/create-a-ca-with-openssl.php
		+	$ openssl req -new -x509 -days 5475 -newkey rsa:4096 -extensions v3_ca -keyout private/ca-0x20-key.pem -out ca-0x20-cert.pem -config ./openssl.cnf