Creating a Signing Authority with openssl

345

1.Click the Examine Certificate button to see the details of the certificate (see the following figure).

2.Click the Details tab, and then highlight the Issuer line in the Certificate Field frame.

In the Field Value frame, you’ll see the name and e-mail address of the certificate issuer. You can decide for yourself if this person is trustworthy.

Creating a Signing Authority with openssl

Use openssl to create a certificate authority (CA) yourself if you want to sign certificates for use within your organization. Running your own CA can be useful if you want to hand out trusted software to other people in your organization. A CA is also useful if you want to serve secure content (payroll benefits and in-house sales, for example).

A CA has three responsibilities:

Verifying identity

Signing requests

Maintaining a database of signed certificates

openssl comes with a program that can handle the last two responsibilities for you. You still have to verify identities yourself using whatever method is appropriate for your site: If you are creating a CA for your company, a photo ID card may be sufficient.

Creating a certificate authority

To create a CA, follow these steps:

1. Open a terminal window and give yourself superuser privileges with the su - command:

$ su - Password:

#

2. If you’re using Fedora or SuSE, move to the directory that contains the CA shell script:

# cd /usr/share/ssl/misc

If you’re using Mandrake:

# cd /usr/lib/ssl/misc

3.Create the CA infrastructure with the following command:

# ./CA -newca

346 Technique 45: Safeguarding Your Apache Server with SSL Certificates

On Mandrake and SuSE systems, use this command instead:

# ./CA.sh -newca

The CA script now asks you a series of questions, most of which will be familiar by now. The first step in creating the CA infrastructure is to create a new, self-signed certificate. You’re prompted for an existing CA certificate:

CA certificate filename (or enter to create)

4. Just press Enter to create a new certificate.

5. Enter a passphrase that will protect your CA’s private key:

Making CA certificate ...

Generating a 1024 bit RSA private key

.................++++++

writing new private key to ‘./demoCA/private/./cakey.pem’

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

6. The CA script prompts you for the same bits of information that you provide when creating a self-signed certificate or a certificate signing request. Answer each question in turn.

After you’ve answered the last question, the CA script creates a self-signed certificate in

./demoCA/cacert.pem.

Take a peek at this certificate with the following command:

# openssl x509 -in demoCA/cacert.pem -text

Notice that the issuer and the subject are identical — that tells you that this is a self-signed certificate.

Signing a CSR

When you have a CA up and running, you can start to sign CSRs (converting them from requests into actual certificates).

To sign a CSR, follow these steps:

1. Open a terminal window and give yourself superuser privileges with the su - command:

$ su - Password:

#

2. Move to the directory that contains the CA shell script:

#cd /usr/share/ssl/misc

3.Type in the following command:

#openssl ca -policy policy_anything \ -in filename.csr \

-out filename.crt

Substitute the CSR name where you see filename.csr and the desired certificate name where you see filename.crt. For example, if you want to sign the CSR for your own Apache Web server, you would type this:

# openssl ca -policy policy_anything \ -in /etc/httpd/conf/ssl.csr/server.

csr\

-out /etc/httpd/conf/ssl.crt/server. crt

Next, the openssl program asks for the passphrase that protects your CA’s private key:

Enter passphrase for ./dem...

/cakey.pem:

4. Type in the password that you assigned when you created the CA and press Enter.

openssl displays the content of the CSR (in human-readable form) and asks if you want to sign the certificate.

5. Look over the content, and if the information looks correct, press Y and then Enter to sign it.

6. openssl asks if you want to commit your changes to the CA database: Press Y and then Enter to finish.

That’s it! The new, signed certificate is saved in the file that you specified. If you signed the certificate for another user, e-mail the certificate to the recipient. If you signed a certificate that you want to use in

Exploring Your Certificate Collection with Mozilla

347

your Web server (and you followed our example), the certificate is already in place in /etc/httpd/ conf/ssl.crt/server.crt; all you have to do now is restart httpd (the Apache server):

# service httpd restart Stopping httpd: [OK] Starting httpd: Apache/2.0.47 mod_ssl/2.0.47

(Pass Phrase Dialog)

Some of your private key files are encrypted for security reasons.

In order to read them you have to provide us with the pass phrases.

Server localhost.localdomain:443 (RSA) Enter pass phrase:

Ok: Pass Phrase Dialog successful.

Trusting in Trusted Certification

Authorities

When customers visit a Web site with the intent to make a purchase, they want a serious guarantee that their personal information — name, address, and credit card number — isn’t being distributed across the Internet for just anyone to use.

When you connect to a Web site secured with an SSL certificate, a little gold padlock appears in the browser tray. Hover your mouse over the lock icon to see a short description of the CA that signed the certificate. To see more information about the certificate (and the signer), click the lock icon. In the Page Info window that appears, click View to see all the gory details.

Exploring Your Certificate Collection with Mozilla

As you browse the World Wide Web, you’re bound to encounter certificates from various sites. How does

your Web browser know which certificates to trust? Each browser (Mozilla, Internet Explorer, Netscape, and so on) comes with a set of predefined trusted authorities.

To explore the certificates and authorities trusted by your Mozilla browser, follow these steps (the procedure is similar if you’re using a browser other than Mozilla):

1. Open the Main Menu and choose Internet Mozilla Web Browser.

The Mozilla Web browser opens.

2. To view the certificate authorities that are currently trusted by your Mozilla browser, choose Edit Preferences.

The Preferences dialog opens.

3. Expand the Privacy & Security portion of the tree control in the Category column and then click Certificates.

The Certificates dialog opens, as shown in Figure 45-1.

•Figure 45-1: The Certificates dialog.

4.Click the Manage Certificates button to open the Certificate Manager.

348 Technique 45: Safeguarding Your Apache Server with SSL Certificates

5. Click the Authorities tab to see the signing authorities trusted by your browser (see Figure 45-2).

You can remove certificates that are currently accepted by Mozilla with a click of the mouse in the Certificate Manager. If you want to remove a certificate, highlight the certificate and click the Delete button. You’ll be asked to verify that you want to delete the certificate — click OK, and it’s history.

7. You can view additional certificate details by clicking the Details tab on the Certificate Viewer (see Figure 45-4).

•Figure 45-2: The authorities trusted by our browser.

6.Highlight a certificate name and click the View button (located in the lower left-hand corner of the Certificate Manager window).

The Certificate Viewer dialog opens with information about the certificate, as shown in Figure 45-3.

• Figure 45-4: Detailed certificate information.

8. Highlight the fields in the tree control in the center pane to view the specific details of the certificate in the Field Value pane.

• Figure 45-3: Information about a specific CA.