|
⇤ ← Revision 1 as of 2006-12-09 00:57:39
Size: 1845
Comment:
|
Size: 1944
Comment: No passphrase for server keys
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 24: | Line 24: |
| I followed the instructions on this page: | I followed the instructions on these pages: |
| Line 27: | Line 27: |
| http://www.postgresql.org/docs/8.1/interactive/ssl-tcp.html |
|
| Line 28: | Line 30: |
| {{{openssl req -new -keyout serverkey.pem -out newreq.pem -days 365 | {{{openssl genrsa -out serverkey.pem openssl req -new -key serverkey.pem -out newreq.pem -days 365 |
| Line 30: | Line 33: |
| openssl -config /etc/domtool/openssl.cfg ca -policy policy_anything -out servercert.pem -infiles new.pem}}} | openssl ca -config /etc/domtool/openssl.cnf -policy policy_anything -out servercert.pem -infiles new.pem}}} |
These instructions assume you are running as user domtool on deleuze.hcoop.net.
1. Creating a certificate authority
I followed the instructions on this page:
This blog post revealed the source of a puzzling error:
It turns out leaving some fields (like the city name for your new certificate) blank leads to baffling messages!
Extracting the relevant commands from the Makefile available at the former page, we run these commands to create our CA: {{{mkdir crl newcerts private chmod go-rwx private echo '01' > serial touch index # NOTE use "-newkey rsa:2048" if running OpenSSL 0.9.8a or higher openssl req -nodes -config openssl.cnf -days 1825 -x509 -newkey rsa -out ca-cert.pem -outform PEM}}}
Now the directory structure of our CA exists, and we have the certificate we will use to sign certificates.
2. Creating a certificate for a node or user
I followed the instructions on these pages:
The commands to run are: {{{openssl genrsa -out serverkey.pem openssl req -new -key serverkey.pem -out newreq.pem -days 365 cat newreq.pem serverkey.pem > new.pem openssl ca -config /etc/domtool/openssl.cnf -policy policy_anything -out servercert.pem -infiles new.pem}}} replacing serverkey.pem and servercert.pem with appropriate names for your new key and certificate, respectively. The change I made from [http://marc.theaimsgroup.com/?l=openssl-users&m=97049654211960&w=2 the cited source] is to include the -config flag to reference the modified config file obtained from [http://sial.org/howto/openssl/ca/ the page about creating a CA].
Once I figure out the final directory layout, there will be instructions here on where to put these files once they're created.