SSL Self-signed Certificates

OpenBSD ships with built in support for OpenSSL and OpenSSH for secure encrypted end-to-end communication between a localhost and a remotehost. Following are notes on configuring and using SS# (pronounced S-S-Sharp, that's a pun)

[Last verified with OpenBSD 3.5 June 2004]

[Ref: OpenBSD FAQ | mod_ssl/ssl_faq.html | /var/www/conf/httpd.conf]

SSL Communications assume the server has an authentication certificate which acts as a verification for whom the server publishes itself to be, and provides an envelope for the server's public key with which clients can encrypt communications bound for the server.

Creating a certificate was initially meant for a third-party authority to assist you in verifying that the server is who they say they are, so the creation of a self signing certificates requires 3 stages (a) creating a private signing key (b) creating a certificate request, and (c) self-authenticating your certificate request.

We are choosing our file names based on the standard OpenBSD/Apache configuration for SSLfiles

from /var/www/conf/httpd.conf

$ grep SSLCertificate /var/www/conf/httpd.conf

SSLCertificateFile    /etc/ssl/server.crt
SSLCertificateKeyFile /etc/ssl/private/server.key

1. Generate a Signing key

# /usr/sbin/openssl genrsa -out /etc/ssl/private/server.key 4096

The generated key acts as our RSA private key for our 'internal' CA (Certificate Authority.)

We can call the key anything we want, and the general mod_ssl example is ca.key, but in the above scenario we will use server.key. Check the mod_ssl documentation for why it may be a better option to use 1024 bit key instead of 4096.

2. Generate a certificate signing request (csr)

We now generate a csr using the server key generated above (output will be PEM formatted.)

# /usr/sbin/openssl req -new \
    -key /etc/ssl/private/server.key \
    -out /etc/ssl/private/server.csr

The above certificate request will prompt you to reply to a number of questions, most of which can be left as the default. You will be asked for the Fully Qualified Domain Name for this host. In my experience this requires the legitimate DNS name that the host will be responding to.

The last part of the above instructions is to ask for 'extra' attributes.

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

For my test configuration (ie. I don't want to enter the password everytime I want to start Apache) I do not enter a 'challange password.' On a security conscious system, you probably want to specify a challenge password here and have someone on 24-hour availability incase the server restarts and someone must enter the 'challenge password' before the server starts.

The concept is that you send the above CSR for a trusted third party to sign, and record in their system, so users who recieve your key can validate from the trusted third party that you are who you are. But we don't want no third party saying who we are (for now anyway.)

3. Create a self-signed certificate (X509 structure.)

the output will be PEM formatted. (The documentation discusses a script sign.sh to do this task for you, but I can only find CA.pl and CA.sh with similar 'purpose.')

# /usr/sbin/openssl x509 -req -days 3650 \
    -in /etc/ssl/private/server.csr \
    -signkey /etc/ssl/private/server.key \
    -out     /etc/ssl/server.crt

# openssl rsa -noout -text -in /etc/ssl/private/server.key 
# openssl req -noout -text -in /etc/ssl/private/server.csr
# openssl x509 -noout -text -in /etc/ssl/server.crt

NameVirtualHost 192.168.101.49:*
<VirtualHost 192.168.101.49:*>
    ServerAdmin samt@qsc.com
    DocumentRoot /var/www/twig
    ServerName virtualsite.com
    ErrorLog logs/virtualsite.com-error_log
    CustomLog logs/virtualsite.com-access_log common
    SSLEngine on
    SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
    SSLCertificateFile /etc/ssl/virtualsite.com.crt
    SSLCertificateKeyFile /etc/ssl/private/server.key
</VirtualHost>

openssl x509 -in input.crt -inform DER -out output.crt -outform PEM

openssl pkcs12 -export -in input.pem -inkey key.pem -out output.p12

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key \
-in certificate.crt -certfile CACert.crt

openssl pkcs12 -in input.p12 -out output.pem -nodes -clcerts

openssl pkcs12 -in keyStore.pfx -out keyStore.pem -nodes

openssl rsa -in input.key -inform DER -out output.key -outform PEM

openssl rsa -in input.key -inform NET -out output.key -outform PEM