CA作り直し
何度やっても忘れる...
opensslの設定ファイル場所
/etc/pki/tls/openssl.cnf
openssl設定ファイル抜粋
####################################################################
[ ca ]
default_ca = CA_default # The default ca section
####################################################################
[ CA_default ]
dir = /etc/pki/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several certs with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
なるべくデフォルト値を使う
ファイル名は、キーは xxxkey.pem 証明書は xxxcert.pem とする。
コマンドは /etc/pki/CA で実行する。
CAの秘密鍵の場所は
/etc/pki/CA/private.cakey.pem
CA証明書は
/etc/pki/CA/cacert.pem
CAの秘密鍵生成
# openssl genrsa -aes256 -out ./private/cakey.pem
Generating RSA private key, 2048 bit long modulus (2 primes)
..............+++++
..............+++++
e is 65537 (0x010001)
Enter pass phrase for ./private/cakey.pem:
Verifying - Enter pass phrase for ./private/cakey.pem:
CA秘密鍵の場所
/etc/pki/CA/private/cakey.pem
CAのcsr作成（openssl.cnfにデフォルト値を設定）
# openssl req -new -key ./private/cakey.pem -out ./cacert.csr
Enter pass phrase for ./private/cakey.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [JP]:
State or Province Name (full name) [Tokyo]:
Locality Name (eg, city) [Shinjuku]:
Organization Name (eg, company) [example]:
Organizational Unit Name (eg, section) [tech]:
Common Name (eg, your name or your server's hostname) []:myca.example.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
CAのcsrに自己署名してCAの証明書を生成
openssl x509 -days 365 -in ./cacert.csr -req -signkey ./private/cakey.pem -out ./cacert.pem
/etc/pki/CA/cacert.pem
サーバ証明書作成
今回作成する証明書はpaloaltoのglobal protectで使う
サーバの秘密鍵作成
# openssl genrsa -aes256 -out ./gpkey.pem 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
.................................................................+++++
...................+++++
e is 65537 (0x010001)
Enter pass phrase for ./gpkey.pem:
Verifying - Enter pass phrase for ./gpkey.pem:
/etc/pki/CA/gpkey.pem
サーバのCSR発行
# openssl req -new -key ./gpkey.pem -out ./gp.csr
Enter pass phrase for ./gpkey.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [JP]:
State or Province Name (full name) [Tokyo]:
Locality Name (eg, city) [Shinjuku]:
Organization Name (eg, company) [example]:
Organizational Unit Name (eg, section) [tech]:
Common Name (eg, your name or your server's hostname) []:hoge.example.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
/etc/pki/CA/gp.csr
拡張属性指定
# cat myext.txt
extendedKeyUsage = 1.3.6.1.5.5.7.3.1
subjectAltName=DNS:hoge.example.com
global protectは下記の情報を参考に設定した。
paloaltoではCA証明書とサーバ証明書を発行できる。（自己署名）
しかし、その証明書を使うとiphone接続時に証明書のエラーになってしまう。
https://hirotanoblog.com/paloalto-globalprotect-local-db/4784/#toc1
iOSやmacosでは、拡張属性が設定されている必要があるらしい。
https://support.apple.com/en-in/HT210176
そのためにわざわざcentosのopensslで証明書を発行した。
CAサイン=証明書発行
# openssl ca -in ./gp.csr -keyfile ./private/cakey.pem -cert ./cacert.pem -out ./gp.pem -extfile ./myext.txt
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ./private/cakey.pem:
Check that the request matches the signature
Signature ok
ERROR:There is already a certificate for /C=JP/ST=Tokyo/O=example/OU=tech/CN=hoge.example.com
The matching entry has the following details
Type :Valid
Expires on :320203233742Z
Serial Number :06
File name :unknown
Subject Name :/C=JP/ST=Tokyo/O=example/OU=tech/CN=hoge.example.com
前回発行した証明書が有効なためerrorが出た。
よくあるケースなのであえて残す
この場合はrevokeする
# ls ./newcerts/ -l
合計 32
-rw-r--r--. 1 root root 4002 6月 5 2021 01.pem
-rw-r--r--. 1 root root 4002 6月 6 2021 02.pem
-rw-r--r--. 1 root root 4002 6月 6 2021 03.pem
-rw-r--r--. 1 root root 4002 6月 6 2021 04.pem
-rw-r--r--. 1 root root 4161 2月 6 08:31 05.pem
-rw-r--r--. 1 root root 5631 2月 6 08:37 06.pem
# openssl ca -revoke ./newcerts/06.pem
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Revoking Certificate 06.
Data Base Update
再署名
# openssl ca -in ./gp.csr -keyfile ./private/cakey.pem -cert ./cacert.pem -out ./gp.pem -extfile ./myext.txt
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ./private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 7 (0x7)
Validity
Not Before: Feb 6 01:15:35 2022 GMT
Not After : Feb 6 01:15:35 2023 GMT
Subject:
countryName = JP
stateOrProvinceName = Tokyo
organizationName = example
organizationalUnitName = tech
commonName = hoge.example.com
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Subject Alternative Name:
DNS:hoge.example.com
Certificate is to be certified until Feb 6 01:15:35 2023 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
作った証明書の中身を確認
# openssl x509 -in ./gp.pem -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 7 (0x7)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = JP, ST = Tokyo, L = Shinjuku, O = example, OU = tech, CN = myca.example.com
Validity
Not Before: Feb 6 01:15:35 2022 GMT
Not After : Feb 6 01:15:35 2023 GMT
Subject: C = JP, ST = Tokyo, O = example, OU = tech, CN = hoge.example.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:b2:de:1f:bb:12:39:56:0f:4b:77:9c:5f:96:d2:
（略）
87:27:1a:0f:42:d8:f8:bd:b3:3c:25:dd:be:fa:92:
1f:bb
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Subject Alternative Name:
DNS:hoge.example.com
Signature Algorithm: sha256WithRSAEncryption
66:76:ea:36:f8:9d:19:16:6f:3a:6c:1d:c1:b0:a8:f1:89:88:
（略）
0b:74:e9:7e:f5:a1:ae:e1:a5:aa:b6:6b:62:7a:a8:14:7c:6a:
b6:53:a5:d8
-----BEGIN CERTIFICATE-----
MIIDczCCAlugAwIBAgIBBzANBgkqhkiG9w0BAQsFADBrMQswCQYDVQQGEwJKUDEO
（略）
tAt06X71oa7hpaq2a2J6qBR8arZTpdg=
-----END CERTIFICATE-----
証明書と秘密鍵をpfx形式にする
# openssl pkcs12 -export -out ./gp.pfx -inkey ./gpkey.pem -in ./gp.pem
Enter pass phrase for ./gpkey.pem:
Enter Export Password:
Verifying - Enter Export Password:
pfxファイルをダウンロードする
tera termのSSH SCPが簡単
ファイルの属性を 666にしてから（最低必要な権限は何だろう？）
chmod 666 gp.pfx