.. vim: noexpandtab fileencoding=utf-8 nomodified wrap textwidth=200 foldmethod=marker foldmarker={{{,}}} foldcolumn=4 ruler showcmd lcs=tab\:|- list
:date: 2023.03.19 19:13:15
:tags: Cobra-Mk3,gentoo
:authors: Gilhad
:summary: SSL SAN certifikat
:title: 2023.03.19 SSL SAN certifikat
%HEADER%
Create Your Own SSL Certificate Authority for Local HTTPS Development
================================================================================
https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/
we’re ready to generate the private key to become a local CA:
.. code::
openssl genrsa -des3 -out myCA.key 2048
Next, we generate a root certificate:
.. code::
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.pem
You should now have two files: myCA.key (your private key) and myCA.pem (your root certificate).
Congratulations, you’re now a CA. Sort of.
Note: Important: if you want your CA certificate to work on Android properly, then add the following options when generating CA: openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.pem -reqexts v3_req -extensions v3_ca
#Adding the Root Certificate to Linux
================================================================================
# {{{
There are so many Linux distributions, but Ubuntu is by far the most popular and it’s what we used when we built SpinupWP. Therefore these instructions will cover Ubuntu.
If it isn’t already installed, install the ca-certificates package.
.. code::
emerge -avq app-misc/ca-certificates
Copy the myCA.pem file to the /usr/local/share/ca-certificates directory as a myCA.crt file.
.. code::
cp ~/certs/myCA.pem /usr/local/share/ca-certificates/myCA.crt
Update the certificate store.
.. code::
update-ca-certificates
You can test that the certificate has been installed by running the following command:
.. code::
awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt | grep Hellfish # grep -i gilhad or whatever we used
awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print | cmd}' < myCA.pem # to see it without installation
# }}}
Creating CA-Signed Certificates for Your Dev Sites
================================================================================
Now we’re a CA on all our devices and we can sign certificates for any new dev sites that need HTTPS. First, we create a private key for the dev site (hellfish.test / wiki.gilhad.cz). Note that we name the private key using the domain name URL of the dev site. This is not required, but it makes it easier to manage if you have multiple sites:
.. code::
openssl genrsa -out hellfish.test.key 2048
Then we create a CSR:
.. code::
openssl req -new -key hellfish.test.key -out hellfish.test.csr
You’ll get all the same questions as you did above and, again, your answers don’t matter. In fact, they matter even less because you won’t be looking at this certificate in a list next to others.
Finally, we’ll create an X509 V3 certificate extension config file, which is used to define the Subject Alternative Name (SAN) for the certificate. In our case, we’ll create a configuration file called **hellfish.test.ext** containing the following text:
.. code::
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = hellfish.test
We’ll be running openssl x509 because the x509 command allows us to edit certificate trust settings. In this case we’re using it to sign the certificate in conjunction with the config file, which allows us to set the Subject Alternative Name. I originally found this answer on Stack Overflow.
Now we run the command to create the certificate: using our CSR, the CA private key, the CA certificate, and the config file:
.. code::
openssl x509 -req -in hellfish.test.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out hellfish.test.crt -days 825 -sha256 -extfile hellfish.test.ext
We now have three files: **hellfish.test.key** (the private key), hellfish.test.csr (the certificate signing request, or csr file), and **hellfish.test.crt** (the signed certificate). We can configure local web servers to use HTTPS with the private key and the signed certificate.
If you’re on Linux or Windows using Apache, you’ll need to enable the Apache SSL mod, and configure an Apache virtual host for port 443 for the local site. It will require you to add the SSLEngine, SSLCertificateFile, and SSLCertificateKeyFile directives, and point the last two to the certificate and key file you just created.
.. code::
#*
ServerName hellfish.test
DocumentRoot /var/www/hellfish-test
SSLEngine on
SSLCertificateFile /path/to/certs/hellfish.test.crt
SSLCertificateKeyFile /path/to/certs/hellfish.test.key
Tak a aplikace na můj problém
================================================================================
skript_CA
--------------
.. code::
#!/bin/bash
# vim: fileencoding=utf-8:nowrap:textwidth=0:foldmethod=marker:foldcolumn=4:ruler:showcmd:lcs=tab\:|- list
echo '01' > serial
touch index.txt
mkdir -p priv
mkdir -p public
mkdir -p server
mkdir -p certs
################################################################################
cat >openssl.cnf <>.gitignore
echo index.txt.attr.old >>.gitignore
echo serial.old >>.gitignore
#####################################
git add certs priv public server index.txt openssl.cnf serial .gitignore
skript_web
--------------
.. code::
#!/bin/bash
# vim: fileencoding=utf-8:nowrap:textwidth=0:foldmethod=marker:foldcolumn=4:ruler:showcmd:lcs=tab\:|- list
if [ $# == "0" ] ; then
echo "$0 name.for.cert web.name.cz alt.name.1 [alt.name.2 ...]"
echo " eg.: ./skript_web gilhad.cz *.gilhad.cz gilhad.cz *.gilhad.cz"
exit
fi
save_as=$1
shift
web=$1
shift
alt_names=$1
if [ "${alt_names}" == "" ] ; then
alt_names=${web}
fi
if [ "${alt_names}" == "" ] ; then
alt_names=${save_as}
fi
if [ "${web}" == "" ] ; then
web=${save_as}`date '+ %Y.%m.%d %H:%M:%S'`
fi
cat >v3_req.ext <> v3_req.ext
shift
if [ $# == 0 ] ; then break; fi
alt_names=$1
done
mkdir -p priv
mkdir -p public
mkdir -p server
mkdir -p certs
################################################################################
cat >openssl.web.cnf <`_