zydronium/internetee-registry
1
0
Fork 0
mirror of https://github.com/internetee/registry.git synced 2025-05-18 10:19:45 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merged certificate doc

Browse source
This commit is contained in:
Priit Tark 2015-02-26 11:48:38 +02:00
parent 4e5d7aea49
commit f11af415d9
2 changed files with 115 additions and 201 deletions
Download patch file Download diff file Expand all files Collapse all files

92
README.md
View file

@ -186,98 +186,10 @@ All registry demo data can be found at:
Initially you can use two type of users: admin users and EPP users. Initially you can use two type of users: admin users and EPP users.
### CA ### Certificates setup
Go to registry shared folder and setup CA directory tree: * [Certificates setup](/doc/certificates.md)
```
mkdir ca
cd ca
mkdir certs crl newcerts private csrs
chmod 700 private
touch index.txt
echo 1000 > serial
echo 1000 > crlnumber
```
Generate the root key (prompts for pass phrase):
```
openssl genrsa -aes256 -out private/ca.key.pem 4096
```
Configure OpenSSL:
```
sudo su -
cd /etc/ssl/
cp openssl.cnf openssl.cnf.bak
nano openssl.cnf
exit
```
Make sure the following options are in place:
```
[ CA_default ]
# Where everything is kept
dir = /home/registry/registry/shared/ca
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
[ v3_ca ]
# Extensions for a typical CA
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
keyUsage = cRLSign, keyCertSign
# For the CA policy
[ policy_match ]
countryName = optional
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
```
Issue the root certificate (prompts for additional data):
```
openssl req -new -x509 -days 3650 -key private/ca.key.pem -sha256 -extensions v3_ca -out certs/ca.crt.pem
chmod 444 certs/ca.crt.pem
```
Create a CSR for the webclient:
```
openssl genrsa -out private/webclient.key.pem 4096
chmod 400 private/webclient.key.pem
openssl req -sha256 -new -key private/webclient.key.pem -out csrs/webclient.csr.pem
```
Sign the request and create certificate:
```
openssl ca -keyfile private/ca.key.pem -cert certs/ca.crt.pem -extensions usr_cert -notext -md sha256 -in csrs/webclient.csr.pem -out certs/webclient.crt.pem
```
Create certificate revocation list (prompts for pass phrase):
```
openssl ca -keyfile private/ca.key.pem -cert certs/ca.crt.pem -gencrl -out crl/crl.pem
```
Certificates for API Users are generated via the user interface. CSR must be uploaded for each API User.
Private key and certificate must be packaged to pkcs12 and added to the browser.
Make sure application configuration files contain correct paths to certificates.
In test environment it's important to set unique_subject option to false.
In CA directory:
```
echo "unique_subject = no" > index.txt.attr
```
### EPP web client ### EPP web client

188
doc/certificate.md
View file

@ -1,100 +1,99 @@
Setting up certificates Certificates setup
----------------------- ------------------
Go to registry shared folder and setup CA directory tree: Certificates for API Users are generated via registnry admin user interface.
``` CSR must be uploaded for each API User.
mkdir ca
cd ca Private key and certificate must be packaged to pkcs12 and added to user browser.
mkdir certs crl newcerts private csrs
chmod 700 private
touch index.txt ### Registry setup
echo 1000 > serial
echo 1000 > crlnumber Setup CA directory tree:
```
cd /home/registry/registry/shared
mkdir ca
cd ca
mkdir certs crl newcerts private csrs
chmod 700 private
touch index.txt
echo 1000 > serial
echo 1000 > crlnumber
Generate the root key (prompts for pass phrase): Generate the root key (prompts for pass phrase):
```
openssl genrsa -aes256 -out private/ca.key.pem 4096 openssl genrsa -aes256 -out private/ca.key.pem 4096
```
Configure OpenSSL: Configure OpenSSL:
```
sudo su - sudo su -
cd /etc/ssl/ cd /etc/ssl/
cp openssl.cnf openssl.cnf.bak cp openssl.cnf openssl.cnf.bak
nano openssl.cnf nano openssl.cnf
exit exit
```
Make sure the following options are in place: Make sure the following options are in place:
```
crl_extensions = crl_ext
[ CA_default ] crl_extensions = crl_ext
# Where everything is kept
dir = /home/registry/registry/shared/ca
[ usr_cert ] [ CA_default ]
# These extensions are added when 'ca' signs a request. # Where everything is kept
basicConstraints=CA:FALSE dir = /home/registry/registry/shared/ca
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
[ v3_ca ] [ usr_cert ]
# Extensions for a typical CA # These extensions are added when 'ca' signs a request.
subjectKeyIdentifier=hash basicConstraints=CA:FALSE
authorityKeyIdentifier=keyid:always,issuer keyUsage = nonRepudiation, digitalSignature, keyEncipherment
basicConstraints = CA:true nsComment = "OpenSSL Generated Certificate"
keyUsage = cRLSign, keyCertSign subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
# For the CA policy [ v3_ca ]
[ policy_match ] # Extensions for a typical CA
countryName = optional subjectKeyIdentifier=hash
stateOrProvinceName = optional authorityKeyIdentifier=keyid:always,issuer
organizationName = optional basicConstraints = CA:true
organizationalUnitName = optional keyUsage = cRLSign, keyCertSign
commonName = supplied
emailAddress = optional # For the CA policy
``` [ policy_match ]
countryName = optional
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
Issue the root certificate (prompts for additional data): Issue the root certificate (prompts for additional data):
```
openssl req -new -x509 -days 3650 -key private/ca.key.pem -sha256 -extensions v3_ca -out certs/ca.crt.pem openssl req -new -x509 -days 3650 -key private/ca.key.pem -sha256 -extensions v3_ca -out certs/ca.crt.pem
chmod 444 certs/ca.crt.pem chmod 444 certs/ca.crt.pem
```
Create a CSR for the webclient: Create a CSR for the webclient:
```
openssl genrsa -out private/webclient.key.pem 4096 openssl genrsa -out private/webclient.key.pem 4096
chmod 400 private/webclient.key.pem chmod 400 private/webclient.key.pem
openssl req -sha256 -new -key private/webclient.key.pem -out csrs/webclient.csr.pem openssl req -sha256 -new -key private/webclient.key.pem -out csrs/webclient.csr.pem
```
Sign the request and create certificate: Sign the request and create certificate:
```
openssl ca -keyfile private/ca.key.pem -cert certs/ca.crt.pem -extensions usr_cert -notext -md sha256 -in csrs/webclient.csr.pem -out certs/webclient.crt.pem openssl ca -keyfile private/ca.key.pem -cert certs/ca.crt.pem -extensions usr_cert -notext -md sha256 -in csrs/webclient.csr.pem -out certs/webclient.crt.pem
chmod 444 certs/webclient.crt.pem chmod 444 certs/webclient.crt.pem
```
Create certificate revocation list (prompts for pass phrase): Create certificate revocation list (prompts for pass phrase):
```
openssl ca -keyfile private/ca.key.pem -cert certs/ca.crt.pem -gencrl -out crl/crl.pem openssl ca -keyfile private/ca.key.pem -cert certs/ca.crt.pem -gencrl -out crl/crl.pem
```
Configure EPP virtual host: Configure EPP virtual host:
```
sudo nano /etc/apache2/sites-enabled/epp.conf sudo nano /etc/apache2/sites-enabled/epp.conf
```
Replace this line: Replace this line:
```
SSLVerifyClient optional_no_ca SSLVerifyClient optional_no_ca
```
With these lines: With these lines:
```
SSLVerifyClient require SSLVerifyClient require
SSLVerifyDepth 1 SSLVerifyDepth 1
SSLCACertificateFile /home/registry/registry/shared/ca/certs/ca.crt.pem SSLCACertificateFile /home/registry/registry/shared/ca/certs/ca.crt.pem
@ -102,15 +101,13 @@ With these lines:
# Uncomment this when upgrading to apache 2.4: # Uncomment this when upgrading to apache 2.4:
# SSLCARevocationCheck chain # SSLCARevocationCheck chain
RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_CLIENT_S_DN_CN}s" RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_CLIENT_S_DN_CN}s"
```
Configure webclient virtual host: Configure webclient virtual host:
```
sudo nano /etc/apache2/sites-enabled/webclient.conf sudo nano /etc/apache2/sites-enabled/webclient.conf
```
Add these lines: Add these lines:
```
SSLVerifyClient none SSLVerifyClient none
SSLVerifyDepth 1 SSLVerifyDepth 1
SSLCACertificateFile /home/registry/registry/shared/ca/certs/ca.crt.pem SSLCACertificateFile /home/registry/registry/shared/ca/certs/ca.crt.pem
@ -124,26 +121,31 @@ Add these lines:
SSLVerifyClient require SSLVerifyClient require
RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_CLIENT_S_DN_CN}s" RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_CLIENT_S_DN_CN}s"
</Location> </Location>
```
Reload apache: Reload apache:
```
sudo a2enmod headers sudo a2enmod headers
sudo /etc/init.d/apache2 restart sudo /etc/init.d/apache2 restart
```
Configure registry and epp application.yml to match the CA settings: Configure registry and epp application.yml to match the CA settings:
```
ca_cert_path: '/home/registry/registry/shared/ca/certs/ca.crt.pem' ca_cert_path: '/home/registry/registry/shared/ca/certs/ca.crt.pem'
ca_key_path: '/home/registry/registry/shared/ca/private/ca.key.pem' ca_key_path: '/home/registry/registry/shared/ca/private/ca.key.pem'
ca_key_password: 'registryalpha' ca_key_password: 'registryalpha'
crl_path: '/home/registry/registry/shared/ca/crl/crl.pem' crl_path: '/home/registry/registry/shared/ca/crl/crl.pem'
webclient_ip: '54.154.91.240' webclient_ip: '54.154.91.240'
```
Configure webclient application.yml to match the CA settings: Configure webclient application.yml to match the CA settings:
```
cert_path: '/home/registry/registry/shared/ca/certs/webclient.crt.pem'
key_path: '/home/registry/registry/shared/ca/private/webclient.key.pem'
```
cert_path: '/home/registry/registry/shared/ca/certs/webclient.crt.pem'
key_path: '/home/registry/registry/shared/ca/private/webclient.key.pem'
Development env
---------------
In development environment it's convenient to set unique_subject option to false,
thus you can generate quickly as many certs as you wish.
In CA directory:
echo "unique_subject = no" > index.txt.attr