Security/SSL - Historique des versions

Didier : /* Global PKI */

2013-01-28T08:01:44Z

Global PKI

← Version précédente		Version du 28 janvier 2013 à 08:01
Ligne 878 :		Ligne 878 :

	I will keep updated this chapter as the work of the working group on PKI of the Internet Society progress. The Internet Society is also managing the .org Top Level Domain name, so they have a lot of capabilities at hand to solve this e-mail spamming problem.		I will keep updated this chapter as the work of the working group on PKI of the Internet Society progress. The Internet Society is also managing the .org Top Level Domain name, so they have a lot of capabilities at hand to solve this e-mail spamming problem.
			= OpenSSL Usage tips =
			OpenSSL can be a complicated application to be sure. This page intends to shed some light on how to accomplish some typical operations, such as viewing a certificates details or creating a SSL (client) connection to an email server that

			== supports STARTTLS. ==

			View a certificates' details

			openssl x509 -in filename.crt -noout -text

			Where filename corresponds to the X.509 certificate file, which typically would end in .crt, .cert or .pem.

			See also: man x509

			== Viewing the details of a certificate revocation list (CRL) ==

			openssl crl -in filename -noout -text

			Where filename corresponds to the CRL file, which typically would end in .crl or .pem

			See also: man crl

			== DER to PEM conversion ==

			Converts a DER format certificate to PEM - which is more widely used in applications such as apache.

			openssl x509 -out exported-pem.crt -outform pem -text -in derfile.crt -inform der

			See also: man x509

			== Generate the hash value from a certificate ==

			Sometimes useful when you want to store multiple CA certificates as separate files in a directory configured into your application.

			openssl x509 -hash -noout -in certfile.pem

			See also: man x509

			== Testing STARTTLS ==

			Connects to a mail server and starts TLS session, shows all the server certs (certificate chain) with -showcerts.

			openssl s_client -connect test.smtp.org:25 -starttls smtp -showcerts

			Note: only support in newer versions of openssl (check man page for -starttls option) See also: man s_client

Didier : /* 2.5.3. Renew a certificate */

2013-01-06T18:22:54Z

2.5.3. Renew a certificate

← Version précédente		Version du 6 janvier 2013 à 18:22
Ligne 485 :		Ligne 485 :
	-out crl/sopac-ca.crl		-out crl/sopac-ca.crl

	=== ~~2.5.3.~~ Renew a certificate ===		=== Renew a certificate ===

	The user sends you its old certificate request or create a new one based on its private key.		The user sends you its old certificate request or create a new one based on its private key.

Didier : /* 2.5.3. Renew a certificate */

2013-01-06T18:22:34Z

2.5.3. Renew a certificate

← Version précédente		Version du 6 janvier 2013 à 18:22
Ligne 495 :		Ligne 495 :
	You may want to sign the request manually because you have to ensure that the start date and end date of validity of the new certificate are correct.		You may want to sign the request manually because you have to ensure that the start date and end date of validity of the new certificate are correct.

	openssl ca -config /etc/openssl.cnf -policy policy_anything -out newcert.pem \		openssl ca -config /etc/openssl.cnf -policy policy_anything -out newcert.pem \
	-infiles newreq.pem -startdate [now] -enddate [previous enddate+365days]		-infiles newreq.pem -startdate [now] -enddate [previous enddate+365days]

	replace [now] and [previous enddate+365days] by the correct values.		replace [now] and [previous enddate+365days] by the correct values.

	=== Display a certificate ===		=== Display a certificate ===

Didier : /* The openssl.cnf file */

2013-01-06T18:21:28Z

The openssl.cnf file

← Version précédente		Version du 6 janvier 2013 à 18:21
Ligne 384 :		Ligne 384 :
	* Variable names can use the suffixes _default for default value, _min for the minimum number of characters required and _max for the maximum number of characters required.		* Variable names can use the suffixes _default for default value, _min for the minimum number of characters required and _max for the maximum number of characters required.
	* The file is composed of [Sections] of variables.		* The file is composed of [Sections] of variables.
			:* '''dir''': Specifies the base directory.
	dir:		:* '''default_ca''': Specifies which section contains the variables for a default certificate.
			:* '''basicConstraints''': Defines the usage of the certificate, for instance with CA:TRUE, the certificate is a root CA Certificate.
	Specifies the base directory.
	default_ca:

	Specifies which section contains the variables for a default certificate.
	basicConstraints:

	Defines the usage of the certificate, for instance with CA:TRUE, the certificate is a root CA Certificate.

	=== Create the Certification Authority ===		=== Create the Certification Authority ===

Didier : /* Create the Certification Authority */

2013-01-06T18:20:16Z

Create the Certification Authority

← Version précédente		Version du 6 janvier 2013 à 18:20
Ligne 399 :		Ligne 399 :
	To create a certification authority, use the command after correctly editing openssl.cnf:		To create a certification authority, use the command after correctly editing openssl.cnf:

	CA.pl -newca		CA.pl -newca

	The utility will ask you to select a certificate file to act as you CA certificate or you are prompted to create one. Follow the steps to create one as exrecise. In the next chapter we will overwrite this default created CA to create a new one with a longer life span. CA.pl creates only 365 days certificates.		The utility will ask you to select a certificate file to act as you CA certificate or you are prompted to create one. Follow the steps to create one as exrecise. In the next chapter we will overwrite this default created CA to create a new one with a longer life span. CA.pl creates only 365 days certificates.

	== Create a Root Certification Authority Certificate. ==		== Create a Root Certification Authority Certificate. ==

Didier : /* The CA.pl utility */

2013-01-06T18:19:44Z

The CA.pl utility

← Version précédente		Version du 6 janvier 2013 à 18:19
Ligne 164 :		Ligne 164 :
	/usr/sbin/CA.pl needs to be modified to include -config /etc/openssl.cnf in ca and req calls.		/usr/sbin/CA.pl needs to be modified to include -config /etc/openssl.cnf in ca and req calls.

	#$SSLEAY_CONFIG=$ENV{"SSLEAY_CONFIG"};		#$SSLEAY_CONFIG=$ENV{"SSLEAY_CONFIG"};
	$SSLEAY_CONFIG="-config /etc/openssl.cnf";		$SSLEAY_CONFIG="-config /etc/openssl.cnf";
	#$CATOP="./demoCA";		#$CATOP="./demoCA";
	$CATOP="/var/ssl";		$CATOP="/var/ssl";

	=== The openssl.cnf file ===		=== The openssl.cnf file ===

Didier : /* The Symmetric key */

2013-01-06T18:19:12Z

The Symmetric key

← Version précédente		Version du 6 janvier 2013 à 18:19
Ligne 120 :		Ligne 120 :
	Well, Private Key/Public Key encryption algorithms are great, but they are not usually practical. It is asymmetric because you need the other key pair to decrypt. You can't use the same key to encrypt and decrypt. An algorithm using the same key to decrypt and encrypt is deemed to have a symmetric key. A symmetric algorithm is much faster in doing its job than an asymmetric algorithm. But a symmetric key is potentially highly insecure. If the enemy gets hold of the key then you have no more secret information. You must therefore transmit the key to the other party without the enemy getting its hands on it. As you know, nothing is secure on the Internet. The solution is to encapsulate the symmetric key inside a message encrypted with an asymmetric algorithm. You have never transmitted your private key to anybody, then the message encrypted with the public key is secure (relatively secure, nothing is certain except death and taxes). The symmetric key is also chosen randomly, so that if the symmetric secret key is discovered then the next transaction will be totally different.		Well, Private Key/Public Key encryption algorithms are great, but they are not usually practical. It is asymmetric because you need the other key pair to decrypt. You can't use the same key to encrypt and decrypt. An algorithm using the same key to decrypt and encrypt is deemed to have a symmetric key. A symmetric algorithm is much faster in doing its job than an asymmetric algorithm. But a symmetric key is potentially highly insecure. If the enemy gets hold of the key then you have no more secret information. You must therefore transmit the key to the other party without the enemy getting its hands on it. As you know, nothing is secure on the Internet. The solution is to encapsulate the symmetric key inside a message encrypted with an asymmetric algorithm. You have never transmitted your private key to anybody, then the message encrypted with the public key is secure (relatively secure, nothing is certain except death and taxes). The symmetric key is also chosen randomly, so that if the symmetric secret key is discovered then the next transaction will be totally different.

	Symetric Key-->[Public Key]-->Encrypted Symetric Key-->[Private Key]-->Symetric Key		Symetric Key-->[Public Key]-->Encrypted Symetric Key-->[Private Key]-->Symetric Key

	=== Encryption algorithm ===		=== Encryption algorithm ===

Didier : /* Private Key/Public Key */

2013-01-06T18:18:54Z

Private Key/Public Key

← Version précédente		Version du 6 janvier 2013 à 18:18
Ligne 42 :		Ligne 42 :
	One of the problem left is to know the public key of your correspondent. Usually you will ask him to send you a non confidential signed message that will contains his publick key as well as a certificate.		One of the problem left is to know the public key of your correspondent. Usually you will ask him to send you a non confidential signed message that will contains his publick key as well as a certificate.

	Message-->[Public Key]-->Encrypted Message-->[Private Key]-->Message		Message-->[Public Key]-->Encrypted Message-->[Private Key]-->Message

	=== The Certificate ===		=== The Certificate ===

Didier : Page créée avec « = Generalities = == Introduction == Dear reader, like myself, you have intensively read the man pages of the applications of the OpenSSL project, and like myself, you couldn... »

2013-01-06T18:18:29Z

Page créée avec « = Generalities = == Introduction == Dear reader, like myself, you have intensively read the man pages of the applications of the OpenSSL project, and like myself, you couldn... »

Voir les modifications

Security/SSL - Historique des versions

Didier : /* Global PKI */

Didier : /* 2.5.3. Renew a certificate */

Didier : /* 2.5.3. Renew a certificate */

Didier : /* The openssl.cnf file */

Didier : /* Create the Certification Authority */

Didier : /* The CA.pl utility */

Didier : /* The Symmetric key */

Didier : /* Private Key/Public Key */

Didier : Page créée avec « = Generalities = == Introduction == Dear reader, like myself, you have intensively read the man pages of the applications of the OpenSSL project, and like myself, you couldn... »

Didier : /* Global PKI */

Didier : /* 2.5.3. Renew a certificate */

Didier : /* 2.5.3. Renew a certificate */

Didier : /* The openssl.cnf file */

Didier : /* Create the Certification Authority */

Didier : /* The CA.pl utility */

Didier : /* The Symmetric key */

Didier : /* Private Key/Public Key */

Didier : Page créée avec « = Generalities = == Introduction == Dear reader, like myself, you have intensively read the man pages of the applications of the OpenSSL project, and like myself, you couldn... »