X.509 Certificates

This configuration will accept anyone with a certificate from the Xelerance organization in the Toronto locality, regardless of username, hostname, or email address.

There is sometimes confusion about Email= and emailAddress=. Openswan will match both of these to E=.

Generating Certificates with OpenSSL

X.509 Certificates can be generated and managed by various programs. Most people still use the command-line tool that comes with OpenSSL, but you can also look into managed web-based solutions, such as TinyCA. We will be using OpenSSL in our examples to create certificates.

Setting the Time

Since all certificates have time-limited validity, it is very important to have the correct time set on the hosts that are going to use certificates, as well as on the host that creates the certificates. You might think that a few seconds do not matter, but if you generate a certificate and transfer it to a machine that lives fifteen minutes in the past, you will have to wait 15 minutes before that certificate becomes valid. People regularly fall into this trap and waste a lot of time trying to get a connection to work properly, just because the time is set incorrectly. Another common mistake is using newly generated certificates on machines that have a different timezone or a clock that is, or is not, set to GMT. These types of errors are logged clearly though:

Feb19 22:21:02 west pluto[7946]: X.509 certificate is not valid until Mar 19 21:34:55 UTC 2005 (it is now=Feb 19 21:21:02 UTC 2005)

Some operating systems also confuse things by automagically changing the clock for winter time and summer time (Daylight Saving Time).

The easiest and most reliable way to get a consistent time set on all your machines is to use GMT in the hardware clock, and use the Network Time Protocol (NTP). Usually NTP comes as a system service called ntp or ntpd. You can also run a one-time time synchronization at boot using the ntpdate command. On modern Windows machines (2000/XP or newer), you can right-click the clock and configure the computer to use NTP.

Configuring OpenSSL

You should first make a decision whether or not to use the default openssl.cnf or to create your own configuration file just for use with Openswan. We recommend the latter, so you do not interfere with the existing SSL setup of your web server, and so that if your OpenSSL package is upgraded you do not run the risk of losing your changed configuration file. It will also allow you to change the default values to make creating a new certificate much easier. If you are going to be using crypto USB tokens, then you can also change the LoadModule options in this separate configuration file. To use your own openssl.cnf file, set the environment variable OPENSSL_CONF:

# export OPENSSL_CONF=/etc/ipsec.d/openssl.cnf

Alternatively, use -config /path/to/your/openssl.cnf in all your OpenSSL commands.

114