CA and SSL Certificates

Transcription

1 1 For this exercise you must again be root. Login and obtain root privileges: sudo su

2 2 Create a working directory only accessible to root: mkdir ~/ca cd ~/ca chmod og rwx.

3 3 Install openssl if necessary aptitude install openssl

4 4 Consider copying /etc/openssl.cnf to ~/ca and edit it to reflect the local situation see today's slides

5 5 Create a script to create your CA see today's slides

6 6 Create a script to create your CA see today's slides Create your own CA (use a good passphrase!)

7 7 Create a script to create a server key and signing request See today's slides Create a key and signing request for your mail server

8 8 Create a script to sign a server certificate, using the provided signing request See today's slides Create the signed certificate for your mail server

9 9 Do the same (create key and signing request, and create certificate from signing request) for a non server (client) certificate Create a signed client certificate for your mail server

10 10 Assume your neighbor represents the CA Create a key and signing request for your mail server, and let your neighbor create the signed certificate In addition to the signed certificate, what should the CA also provide you with?

11 1 For this exercise you must again be root. Login and obtain root privileges: sudo su

12 2 Create a working directory only accessible to root: mkdir ~/ca cd ~/ca chmod og rwx.

13 3 Install openssl if necessary aptitude install openssl

14 4 Consider copying /etc/openssl.cnf to ~/ca and edit it to reflect the local situation see today's slides

15 5 Create a script to create your CA see today's slides

16 6 Create a script to create your CA see today's slides Create your own CA (use a good passphrase!)

17 7 Create a script to create a server key and signing request See today's slides Create a key and signing request for your mail server

18 8 Create a script to sign a server certificate, using the provided signing request See today's slides Create the signed certificate for your mail server

19 9 Do the same (create key and signing request, and create certificate from signing request) for a non server (client) certificate Create a signed client certificate for your mail server

20 10 Assume your neighbor represents the CA Create a key and signing request for your mail server, and let your neighbor create the signed certificate In addition to the signed certificate, what should the CA also provide you with?