this directory holds CA key + wildcard certificates created for new infrastructure the CA key/cert is "ca-cert.pem/key"
TODO:
- create scripts to re-generate client certificates based on NEW CA
- develop procedure to generate client/server certs from template (partialy done)
- develop procedure to generate clr files + revocate certificate + distribute them on public places
- document structure in client/server CERTS - so it can be used to filter HTTPS logins (per project, etc..)
- completely replace OLD CA in whole infrastructure
For new server certificate add [a-z] or [0-9][0-9] ID before the suffix.
sudo apt-get install gnutls-bin
certtool --generate-privkey --outfile ca-key.pem
certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca-cert.pem \
--template gnutls-certtool.CA.template
This asks questions about the usage of the certificate. To get a ten year one I used the following options:
Common name: ca.lab.xxx The certificate will expire in (days): 3650 Does the certificate belong to an authority? (y/N): y Path length constraint (decimal, -1 for no constraint): -1 Will the certificate be used to sign other certificates? (y/N): y
SRVFQDN=wildcard
certtool --generate-privkey --outfile $SRVFQDN.key
certtool --generate-certificate --load-privkey $SRVFQDN.key \
--outfile $SRVFQDN.crt --load-ca-certificate ca-cert.pem \
--load-ca-privkey ca-key.pem \
--template gnutls-certtool.SERVICE.template
The common name needs to be ldap.edu.example.org for the slapd certificate:
Common name: ldap.lab.xxx The certificate will expire in (days): 3650 Will the certificate be used for signing (required for TLS)? (y/N): y Will the certificate be used for encryption (not required for TLS)? (y/N): y
certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca-cert.pem
Generating a self signed certificate...
Please enter the details of the certificate's distinguished name. Just press enter to ignore a field.
Country name (2 chars): CZ
Organization name: lab
Organizational unit name: devops
Locality name: Prague
State or province name: Prague
Common name: ca.lab.xxx
UID:
This field should not be used in new certificates.
E-mail:
Enter the certificate's serial number in decimal (default: 1452442724):
Activation/Expiration time.
The certificate will expire in (days): 3650
Extensions.
Does the certificate belong to an authority? (y/N): y
Path length constraint (decimal, -1 for no constraint):
Is this a TLS web client certificate? (y/N):
Will the certificate be used for IPsec IKE operations? (y/N):
Is this also a TLS web server certificate? (y/N):
Enter the e-mail of the subject of the certificate:
Will the certificate be used to sign other certificates? (y/N): y
Will the certificate be used to sign CRLs? (y/N): y
Will the certificate be used to sign code? (y/N): y
Will the certificate be used to sign OCSP requests? (y/N): y
Will the certificate be used for time stamping? (y/N): y
Enter the URI of the CRL distribution point: http://pki.blueit.cz/lab.crl
X.509 Certificate Information:
Version: 3
Serial Number (hex): 56928464
Validity:
Not Before: Sun Jan 10 16:18:47 UTC 2016
Not After: Wed Jan 07 16:18:54 UTC 2026
Subject: C=CZ,O=lab,OU=devops,L=Prague,ST=Prague,CN=ca.lab.xxx
Subject Public Key Algorithm: RSA
Certificate Security Level: Normal
Modulus (bits 2432):
00:be:d5:f0:6b:69:4f:10:53:cc:51:7e:b7:e6:69:40
e5:c1:1d:25:3f:59:e3:8a:e9:fa:f2:94:2b:f8:3b:f1
65:65:21:37:2a:40:e7:98:2a:64:d4:e2:c0:f6:66:3f
30:de:64:33:70:bf:67:b1:b7:34:c6:a0:ad:bf:fd:9c
9b:be:a2:b4:a0:a6:3f:30:e3:20:6e:42:51:d7:21:d4
8e:36:33:72:6f:5a:11:f7:62:90:3d:d6:0b:40:71:fe
29:27:ad:58:48:4e:81:b2:c1:f4:cd:c5:c4:98:28:5b
0f:b7:8e:6a:61:d2:8d:e7:cf:79:a6:f7:ab:b9:bc:02
22:03:84:cb:82:c7:05:87:7a:10:3d:72:1d:f8:9b:20
4d:71:20:4b:26:95:85:bc:5a:25:c1:2a:8b:82:61:57
02:fa:3d:70:b3:5b:43:58:a9:d4:63:49:67:a2:80:e0
95:35:49:7d:a8:2a:0b:49:16:93:00:e1:ad:75:22:8c
d5:ad:74:ba:c3:90:2c:3b:3d:96:e3:55:f9:14:98:cf
98:9b:15:ab:26:b9:0d:4f:bb:30:55:91:05:df:18:97
5d:8d:6f:9e:04:1e:f3:f3:5d:b0:f5:27:e7:40:a0:04
82:2e:f2:fd:c5:34:30:a6:2f:64:96:cc:2f:cc:32:1e
fc:ba:d1:3c:8b:85:37:bc:36:f2:dd:48:a3:53:9c:7b
77:d7:2a:dc:2e:91:96:b9:23:57:98:4e:8c:81:3b:ae
d5:19:0f:af:09:93:81:db:03:a8:34:7a:cf:ac:17:f3
99
Exponent (bits 24):
01:00:01
Extensions:
Basic Constraints (critical):
Certificate Authority (CA): TRUE
Key Purpose (not critical):
Code signing.
OCSP signing.
Time stamping.
Key Usage (critical):
Certificate signing.
CRL signing.
Subject Key Identifier (not critical):
06cc727df353de1b8b63b637eb0fb092de71f06f
CRL Distribution points (not critical):
URI: http://pki.blueit.cz/lab.crl
Other Information:
Public Key Id:
06cc727df353de1b8b63b637eb0fb092de71f06f
Is the above information ok? (y/N): y
To get a webserver certificate which Chromium (seen with v98) accepted with
TLSv1.3I had to add the following options tognutls-certtool.SERVICE.template(I haven't tested if both of them are necessary).Otherwise chromium stopped connecting with
ERR_SSL_KEY_USAGE_INCOMPATIBLE(with protocolTLSv1.3allowed in nginx.)