Modify Configuration File Openssl cnf Accordingly

go to ForumEasy.com

JavaPro

Home | MyForum | FAQ | Archive

You are not logged in. [Login] or [Register]


Forum Home » Secure Socket Connectivity (SSL/TLS) » SSL/TLS Certificate Authority via OpenSSL

Email To Friend |

Set Alert To This Topic

Rewarding Points Availabe: 0 (What's this)

New Topic |

Post Reply

Author

Topic: SSL/TLS Certificate Authority via OpenSSL

authen
member
offline

posts:	56
joined:	06/05/2006
from:	San Diego, CA

posted on: 03/07/2008 03:31:08 PM

Edit |

Quote |

Report

SSL/TLS Certificate Authority via OpenSSL

In this mini tutorial, the step-by-step procedures are highlighted in terms of how to set up a root CA (Certificate Authority) and handle the routine tasks by using openSSL.

Profile |

Points Earned: 0

authen
member
offline

posts:	56
joined:	06/05/2006
from:	San Diego, CA

posted on: 03/07/2008 03:33:40 PM

Edit |

Quote |

Report

OpenSSL Download and Installation

OpenSSL for Windows download:

Open openSSL main page: http://www.openssl.org

Go to tab 'Related'

Click on menu 'Binaries'

Download from http://www.slproweb.com/products/Win32OpenSSL.html

Installation:
The downloaded is a .exe file. Simply run it and follow the prompts. After finishing the installation, you should have at least the following files under <dir>/bin directory:

openssl.exe -- the command tool

openssl.cnf -- the default configuration file

CA.pl -- utility hiding the complexity of the openssl command

Profile |

Points Earned: 0

authen
member
offline

posts:	56
joined:	06/05/2006
from:	San Diego, CA

posted on: 03/07/2008 03:35:50 PM

Edit |

Quote |

Report

Modify Configuration File Openssl.cnf Accordingly

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .
RANDFILE		= $ENV::HOME/.rnd

# Extra OBJECT IDENTIFIER info:
#oid_file		= $ENV::HOME/.oid
oid_section		= new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		= 
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several ctificates with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key
RANDFILE	= $dir/private/.rand	# private random number file

x509_extensions	= usr_cert		# The extentions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= sha1			# which md to use.
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 1024
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extentions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options. 
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString.
# utf8only: only UTF8Strings.
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
# so use this option with caution!
string_mask = nombstr

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (eg, YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer:always

# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

Profile |

Points Earned: 0

authen
member
offline

posts:	56
joined:	06/05/2006
from:	San Diego, CA

posted on: 03/07/2008 03:42:35 PM

Edit |

Quote |

Report

Create Your Own Root CA (Certificate Authority)

Create your CA's private key:

C:\OpenSSL\myCA>openssl genrsa -des3 -out cakey.pem 2048

Loading 'screen' into random state - done
Generating RSA private key, 2048 bit long modulus
..........+++
...................................................................+++
e is 65537 (0x10001)
Enter pass phrase for cakey.pem:<passphrase>
Verifying - Enter pass phrase for cakey.pem:<passphrase>

The private key is in 2048 bits and placed in file 'cakey.pem' which is encrypted in des3 with your input passphrase. Keep this file in a safe place like a floppy disk. Here is what the key looks like:

Looks very cute, owha?

Generate your CA's certificate (public key):

Since A root CA's certificate is always a self-signed certificate, you can sign the CSR (certificate Sign Request) with the CA's private key.

C:\OpenSSL\myCA>openssl req -new -x509 -key cakey.pem \
-out cacert.pem -days 3650

Enter pass phrase for cakey.pem:<passphrase>
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Francisco
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Open CA
Organizational Unit Name (eg, section) []:Open CA
Common Name (eg, YOUR name) []:My Root CA
Email Address []:

Your root CA's certificate is valid for 3650 days and is placed in file 'cacert.pem'. The certificate looks like this (in file):

Still very cute. If you are really wondering what's inside anyway, you can display it using x509 utility.

Display a certificate

C:\OpenSSL\myCA>openssl x509 -in cacert.pem -noout -text

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f6:45:07:c2:15:e2:e3:bf
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=California, L=San Francisco, O=Open CA, OU=Open CA, CN=
My Root CA
        Validity
            Not Before: Mar  6 02:23:22 2008 GMT
            Not After : Mar  4 02:23:22 2018 GMT
        Subject: C=US, ST=California, L=San Francisco, O=Open CA, OU=Open CA, CN
=My Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:b4:66:48:0e:df:7b:1e:75:84:4c:c9:79:5b:41:
                    fe:87:35:53:79:40:f7:1e:47:58:4e:d0:47:eb:44:
                    58:23:51:21:0d:54:7f:35:e4:48:e7:a6:c5:40:00:
                    bc:eb:b8:3c:7a:6f:e2:0f:d3:e6:78:3d:44:10:ae:
                    7d:02:af:d1:d2:fb:76:92:e1:cd:d6:7d:af:9c:fb:
                    bd:3a:6c:d0:d1:ce:ec:5c:16:95:14:5d:31:24:01:
                    9f:b9:98:aa:e4:52:44:b3:50:c4:4e:57:3e:7b:5a:
                    4f:92:a4:74:ae:37:f9:4d:ba:ea:81:0f:7d:16:ae:
                    6b:92:e6:50:76:60:1e:6f:b1:ac:92:69:7c:a7:6d:
                    3e:da:0e:21:0b:ab:05:35:df:bf:a4:69:2f:fc:e8:
                    a4:19:a3:59:3b:55:a7:f2:42:4f:d0:b3:9c:a6:86:
                    3d:6b:3b:7d:fe:f8:08:2c:b4:67:19:d8:7c:66:33:
                    e6:a7:4f:b7:a4:00:f0:a9:a7:ee:c0:fe:a6:bf:cd:
                    52:d5:06:ee:48:b4:fe:28:f6:b0:2c:15:6f:16:83:
                    43:15:b1:45:bb:a7:85:aa:2c:1e:69:51:f0:b4:3a:
                    9f:5f:80:56:1c:6c:6c:86:a1:fd:c7:1e:b8:e1:58:
                    70:6d:cf:84:f4:2f:01:80:f7:99:4f:22:62:ff:a0:
                    bb:81
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                18:DE:C7:F0:44:60:79:9D:B4:37:DC:EC:2D:74:54:9F:32:96:44:B8
            X509v3 Authority Key Identifier:
                keyid:18:DE:C7:F0:44:60:79:9D:B4:37:DC:EC:2D:74:54:9F:32:96:44:B
8
                DirName:/C=US/ST=California/L=San Francisco/O=Open CA/OU=Open CA
/CN=My Root CA
                serial:F6:45:07:C2:15:E2:E3:BF

            X509v3 Basic Constraints:
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
        19:7c:ee:b3:d7:e0:86:78:71:c5:d0:52:19:e3:a2:1c:a9:86:
        16:3c:a6:be:c8:8f:ff:ff:dc:86:1f:20:4f:a5:48:c4:9e:84:
        40:fc:8e:08:85:af:1c:08:79:8e:11:31:96:37:7a:68:6f:73:
        95:c9:e8:07:de:b4:03:e5:8c:c0:b8:14:5c:4b:e2:41:8f:33:
        6d:50:84:37:60:26:e9:a9:5b:12:15:d7:68:2c:37:b0:a5:b7:
        57:f6:66:13:f8:c6:e0:cc:09:5a:bc:8a:07:1c:43:39:28:ae:
        0a:1c:5f:80:2c:ce:f0:67:bf:43:c8:0d:14:fc:e4:62:fc:4f:
        77:28:8c:8d:1b:11:d5:38:a1:9a:ff:18:a9:f9:4b:1d:9a:e6:
        0c:bc:f5:28:ab:b8:0c:4d:65:77:fd:5e:8c:87:d8:8b:33:2a:
        64:ce:ab:79:83:0b:90:f0:75:00:2a:88:0f:05:60:4e:9a:6d:
        71:82:1d:de:07:38:1f:cc:64:19:0b:22:53:47:07:e9:40:5b:
        d5:f1:50:aa:3a:c7:8e:0f:ef:44:da:32:6c:cb:16:49:de:c8:
        90:a3:fe:8d:54:6d:82:35:58:e5:38:d4:f7:85:4e:3b:9c:9f:
        05:4c:8f:2b:ad:6d:bb:07:fd:92:4a:e4:b7:f9:a3:18:c3:72:
        2a:7e:cc:9d

Now you have a root Certification Authority. You can sign any certificate requests and maintain a database of all certificates you have issued. Also, you can revoke any certificates and publish a Certificate Revocation List (CRL).

The big challenge left is how to make your CA, essentially your root CA's certificate, publicly aware. Before you release your certificate to public, you probably want to strip the certificate from all its text to keep only the -CERTIFICATE- section and change the file type from .pem to .cer -- just to make your certificate easier to be identified and imported on the client side.

Trim a certificate

C:\OpenSSL\myCA>openssl x509 -in cacert.pem -out cacert.cer

Profile |

Points Earned: 0

authen
member
offline

posts:	56
joined:	06/05/2006
from:	San Diego, CA

posted on: 03/07/2008 07:55:14 PM

Edit |

Quote |

Report

CA Task #1: Sign a Certificate Request

Signing a certificate request means that you have yourself assured the authenticity of the certificate. To sign any message, you create its hash, and then encrypt the hash with your private key, you then add the encrypted hash and your signed certificate with the message. The recipient will recreate the message hash, decrypts the encrypted hash using your well known public key stored in your signed certificate, check that both hash are equals and finally check the certificate.

A certificate request is created by a client and brought here for your CA's trust or endorsement. The creation of client's certificate and request is out of the CA camp, but the process is briefed here for the sake of completeness.

Client: Generate a private key

C:\OpenSSL\client>openssl genrsa -des3 -out privkey.pem 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
.......................++++++
..............++++++
e is 65537 (0x10001)
Enter pass phrase for privkey.pem:<passphrase>
Verifying - Enter pass phrase for privkey.pem:<passphrase>

Client: Generate a certificate request

C:\OpenSSL\client>openssl req -new -key privkey.pem -out cert.csr
Enter pass phrase for privkey.pem:<passphrase>
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:CA
Locality Name (eg, city) []:Sunnyvale
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Test Inc
Organizational Unit Name (eg, section) []:Test Department
Common Name (eg, YOUR name) []:MyTestServer
Email Address []:MyTestServer@testinc.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:<password>
An optional company name []:MyTestProxyServer

CA: Sign a certificate request
Once you have the certificate request 'cert.csr' from the client, you can go ahead to sign it. If this is the first request for your CA, make sure that the file 'index.txt' is empty and that the file 'serial' contains 01.

C:\OpenSSL\myCA>openssl ca -config openssl.cnf -policy policy_anything \
-keyfile cakey.pem -cert cacert.pem -out certnew.pem -days 365 -infiles cert.csr

Using configuration from openssl.conf
Loading 'screen' into random state - done
Enter pass phrase for cakey.pem:<passphrase>
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Mar  6 23:46:32 2008 GMT
            Not After : Mar  6 23:46:32 2009 GMT
        Subject:
            countryName               = US
            stateOrProvinceName       = CA
            localityName              = Sunnyvale
            organizationName          = Test Inc
            organizationalUnitName    = Test Department
            commonName                = MyTestServer
            emailAddress              = MyTestServer@testinc.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                AE:C7:10:89:AE:81:D2:1B:86:06:B1:03:E6:E0:83:D9:9C:6C:40:A6
            X509v3 Authority Key Identifier:
                keyid:18:DE:C7:F0:44:60:79:9D:B4:37:DC:EC:2D:74:54:9F:32:96:44:B
8

Certificate is to be certified until Mar  6 23:46:32 2009 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

This will sign the request 'cert.csr' using your CA's private key 'cacert.pem' and public certificate 'cacert.pem', and commit the certificate as 'certnew.pem'. For management purpose, your CA will automatically generate a identical copy 'xx.pem' under directory ./newcerts. Also beware that the tracking index file 'index.txt' and sequence number file 'serial' have been updated accordingly.

The file 'certnew.pem' is the response to client's request and should be sent back to your client. Here is what the file looks like:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=California, L=San Francisco, O=Open CA, OU=Open CA,
                    CN=My Root CA
        Validity
            Not Before: Mar  6 23:46:32 2008 GMT
            Not After : Mar  6 23:46:32 2009 GMT
        Subject: C=US, ST=CA, L=Sunnyvale, O=Test Inc, OU=Test Department,
                     CN=MyTestServer/emailAddress=MyTestServer@testinc.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:d7:1d:5a:2c:0e:63:c5:3c:1a:94:bf:db:84:90:
                    00:7f:39:17:e9:00:6f:62:15:50:8a:cd:04:a1:ad:
                    54:ca:fa:58:e5:d1:50:46:a8:df:4c:29:ea:22:83:
                    aa:10:d9:d1:c7:d7:ad:06:10:db:00:71:ac:fc:fe:
                    db:ee:6b:c7:94:9d:b5:6a:e6:b4:4a:ce:56:16:ca:
                    03:c0:99:4e:a9:4e:90:62:61:88:3b:6a:38:22:26:
                    7f:99:e2:c2:9f:14:94:38:02:48:e2:ec:d8:95:91:
                    72:3e:6a:d3:ed:e1:9c:31:58:38:e8:28:5f:5d:24:
                    89:38:43:13:4a:95:31:86:09
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                AE:C7:10:89:AE:81:D2:1B:86:06:B1:03:E6:E0:83:D9:9C:6C:40:A6
            X509v3 Authority Key Identifier: 
                keyid:18:DE:C7:F0:44:60:79:9D:B4:37:DC:EC:2D:74:54:9F:32:96:44:B8

    Signature Algorithm: sha1WithRSAEncryption
        26:f9:b0:bf:4d:37:5b:4e:a8:74:c1:75:d5:6d:4b:f1:96:b8:
        cb:4e:c6:e6:7b:0c:8a:e7:da:3d:fb:ec:2e:52:1f:09:5f:87:
        64:9f:c6:d6:46:84:44:90:1a:cf:f8:13:de:6f:e3:7e:ac:00:
        8e:9e:55:a2:e2:a8:7b:44:34:ab:61:e2:85:43:b8:37:77:a7:
        f0:ed:97:34:79:e1:a8:70:3d:06:f9:45:19:4c:1e:ad:e2:4f:
        b9:e6:8c:f9:7b:65:ff:fa:96:e8:c8:aa:26:5e:59:c8:31:74:
        ea:72:a4:6d:50:e5:30:53:13:c5:2f:be:4d:48:be:27:2d:ed:
        cf:ef:25:14:ee:2d:bc:e2:3a:d6:17:4b:bc:dc:f9:1a:b2:ff:
        2c:17:6b:ef:e4:d1:a5:78:b7:4c:b0:9d:a8:2c:2e:c8:eb:6f:
        f2:a1:d1:e7:e4:ca:5b:de:3a:4f:f0:a0:01:1b:c9:6e:82:42:
        cd:80:a2:ec:10:aa:4c:48:19:fd:29:6f:9f:72:04:75:12:67:
        93:be:fd:97:b0:24:06:50:ed:3e:7e:ce:a2:da:e6:be:ea:e0:
        f6:62:eb:2e:e2:a5:28:a5:7f:fe:70:e8:15:58:00:02:d9:4b:
        bf:c6:2a:62:08:1e:2c:64:61:30:ca:fa:4e:d9:28:22:10:eb:
        4a:6c:d5:2b
-----BEGIN CERTIFICATE-----
MIIDgTCCAmmgAwIBAgIBATANBgkqhkiG9w0BAQUFADBzMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEQMA4G
A1UEChMHT3BlbiBDQTEQMA4GA1UECxMHT3BlbiBDQTETMBEGA1UEAxMKTXkgUm9v
dCBDQTAeFw0wODAzMDYyMzQ2MzJaFw0wOTAzMDYyMzQ2MzJaMIGbMQswCQYDVQQG
EwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVN1bm55dmFsZTERMA8GA1UEChMI
VGVzdCBJbmMxGDAWBgNVBAsTD1Rlc3QgRGVwYXJ0bWVudDEVMBMGA1UEAxMMTXlU
ZXN0U2VydmVyMScwJQYJKoZIhvcNAQkBFhhNeVRlc3RTZXJ2ZXJAdGVzdGluYy5j
b20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANcdWiwOY8U8GpS/24SQAH85
F+kAb2IVUIrNBKGtVMr6WOXRUEao30wp6iKDqhDZ0cfXrQYQ2wBxrPz+2+5rx5Sd
tWrmtErOVhbKA8CZTqlOkGJhiDtqOCImf5niwp8UlDgCSOLs2JWRcj5q0+3hnDFY
OOgoX10kiThDE0qVMYYJAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgEN
BB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBSuxxCJ
roHSG4YGsQPm4IPZnGxApjAfBgNVHSMEGDAWgBQY3sfwRGB5nbQ33OwtdFSfMpZE
uDANBgkqhkiG9w0BAQUFAAOCAQEAJvmwv003W06odMF11W1L8Za4y07G5nsMiufa
PfvsLlIfCV+HZJ/G1kaERJAaz/gT3m/jfqwAjp5VouKoe0Q0q2HihUO4N3en8O2X
NHnhqHA9BvlFGUwereJPueaM+Xtl//qW6MiqJl5ZyDF06nKkbVDlMFMTxS++TUi+
Jy3tz+8lFO4tvOI61hdLvNz5GrL/LBdr7+TRpXi3TLCdqCwuyOtv8qHR5+TKW946
T/CgARvJboJCzYCi7BCqTEgZ/Slvn3IEdRJnk779l7AkBlDtPn7Ootrmvurg9mLr
LuKlKKV//nDoFVgAAtlLv8YqYggeLGRhMMr6TtkoIhDrSmzVKw==
-----END CERTIFICATE-----

Obviously, you can strip the extra text by just keeping the content between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- before sending it back to your client as response.

CA: Trim a certificate

C:\OpenSSL\myCA>openssl x509 -in certnew.pem -out certnew.cer

Profile |

Points Earned: 0

authen
member
offline

posts:	56
joined:	06/05/2006
from:	San Diego, CA

posted on: 03/15/2008 06:14:32 PM

Edit |

Quote |

Report

CA Task #2: Revoke a Certificate

To revoke a certificate simply issue the command:

C:\Program Files\OpenSSL\myCA>openssl ca -config openssl.cnf -policy policy_anything \
 -keyfile cakey.pem -cert cacert.pem -revoke certnew.pem

Using configuration from openssl.conf
Loading 'screen' into random state - done
Enter pass phrase for cakey.pem:<passphrase>
Revoking Certificate 01.
Data Base Updated

Noticed that the database file 'index.txt' has been updated and the certificate is marked as R (revoked).

For this certificate's revocation to be publicly known, the CA need to update its CRL (Certificate Revocation List) accordingly.

C:\Program Files\OpenSSL\myCA>openssl ca -gencrl -config openssl.cnf -keyfile cakey.pem \
 -cert cacert.pem  -crldays 7 -out myCA.crl

Using configuration from openssl.conf
Loading 'screen' into random state - done
Enter pass phrase for cakey.pem:<passphrase>

This will retrieve revocation information from database file 'index.txt' and compile them into CRL and put into file 'myCA.crl' -- which is valid and should be updated 7 (-crldays) days after.

This CRL file 'myCA.crl' should be made accessible via HTTP or LDAP.

Profile |

Points Earned: 0

Get your own forum today. It's easy and free.