Certificates
We can consider buying a legitimate certificate, rather than home-brew ones:
You need a key and a certificate to operate your secure server — which means that you can either generate a self-signed certificate or purchase a CA-signed certificate from a CA. What are the differences between the two?
A CA-signed certificate provides two important capabilities for your server:
- Browsers (usually) automatically recognize the certificate and allow a secure connection to be made, without prompting the user.
- When a CA issues a signed certificate, they are guaranteeing the identity of the organization that is providing the webpages to the browser.
The certificate used for LDAP is located at /etc/openldap/root_dn.crt. Do we use the same certificate for everything? If that's only for LDAP then there's no benefit to buying one from an authority, because we're the ones that copy it to each client.
To resign a certificate
To resign a certificate use these two commands:
openssl req -new -key www.physics.unh.edu.key -out www.physics.unh.edu.csr
openssl x509 -req -days 3652 -in www.physics.unh.edu.csr -signkey www.physics.unh.edu.key -out www.physics.unh.edu.crt
Aaron's fantastic certificate stuff
Aaron stopped by for a power cable, and we made him pay for it by telling us that roentgen is our Certificate Authority.
To make a new certificate for a machine ("rood_dn" is the hostname of the server the cert is for):
- log onto roentgen
cd /usr/share/ssl/certs- if a certificate already exists for that machine:
- revoke it with
openssl ca -revoke root_dn.crt - move it to the old folder
- revoke it with
make root_dn.csropenssl req -new -key root_dn.key -out root_dn.csr -subj '/DC=edu/DC=unh/DC=physics/CN=root'openssl ca -policy policy_anything -days 3650 -preserveDN -in root_dn.csr -out root_dn.crtopenssl x509 -nameopt RFC2253 -subject -noout -in /root/.ssl/root_dn.crt- copy these newly generated crt, csr, and key files to /etc/openldap/cacerts/ on the machine they were generated for
