EJBCA with GemSAFE Toolbox Part3 SSL

Size: px

Start display at page:

Download "EJBCA with GemSAFE Toolbox Part3 SSL"

Horace Malone
8 years ago
Views:

1 EJBCA with GemSAFE Toolbox Part3 SSL

2 2 Introduction This document is a continuation form 2 documents namely EJBCA with GemSAFE Toolbox Part1 workstation logon and EJBCA with GemSAFE Toolbox Part2 sign and encrypt . This is the last document in the series. The way to request SSL server certificate from EJBCA was described in sequential manner. But most of the EJBCA setting and configuration were described in the previous documents.

This is the last document in the series.

3 3 Table of Content EJBCA with GemSAFE Toolbox Part3 SSL...1 Introduction...2 Table of Content Create SSL Certificate Profile Create SSL End Entity profile Create SSL End Entity Install IIS Send SSL Certificate Request Fetch SSL Certificate Configure IIS Test SSL...25

4 Create SSL Certificate Profile Go to EJBCA Administration GUI Click Edit Certificate Profiles Type "SSL" in the text box under Add Profile. Click Add Choose SSL under Current Certificate Profiles Click Edit Certificate Profiles Set SSL certificate s profile s parameters a) Under key usage, select Key agreement b) Under available CAs, Select only GS_SCL_CA_v1 leave all other setting by default and click Save The following is the screen capture of the settings 7. 8.

Click Add Choose SSL under Current Certificate Profiles 5. 6.

5 5

6 6

7 7

8 8

9 Create SSL End Entity profile Go to EJBCA Administration GUI Click Edit End Entity Profiles Type "SSL" in the text box under Add Profile. Click Add Choose SSL under Current End Entity Profiles Click Edit Certificate Profile Set SSL certificate s profile s parameters a) Under Domain (Use only the domain part of the address, without the '@' char) uncheck Use b) Under Default Certificate Profile choose SSL c) Under Available Certificate Profile choose SSL d) Under Default CA choose GS_SCL_CA_v1 e) Under Available CAs choose only GS_SCL_CA_v1 leave all other setting by default and click Save The following is the screen capture of the settings 7. 8.

10 10

11 11

12 12

13 Create SSL End Entity Go to EJBCA Administration GUI Click Add Edit Entity Set SSL end entity s parameters a) End Entity Profile=SSL b) User Name=SSL1 c) Password=foo123 d) Confirm Password=foo123 e) CN, Common Name=SSL1 leave all other setting by default and click Add End Entity The following is the screen capture of the settings

$Start\Manage Your Server\Add or remove a role\click Next \Choose Application server(iis, ASP.NET) 2. 3.$

14 Install IIS 1. Start\Manage Your Server\Add or remove a role\click Next \Choose Application server(iis, ASP.NET) Click Next 3 times You may be prompted to insert Windows 2003 server CD during installation process

$\Choose Application server(iis, ASP.NET) 2. 3.$

15 15 4. Click Finish

$-- Send SSL Certificate Request Start\All Programs\Administrative tools\ Internet Information$

16 Send SSL Certificate Request Start\All Programs\Administrative tools\ Internet Information Services (IIS) Manager\CLEAN2003 (local computer)\ Web Sites\right click Default Web Site \Properties

$Programs\Administrative tools\ Internet$

17 Directory Security\Server Certificate Click Next 4 times Organization = Gemalto Organization Unit =FSID

18 6. 7. Click Next Input website s common name, here I use testing.company.cn as example 8. 9. 10. 11.

18 Click Next Input website s common name, here I use testing.company.cn as example Click Next Country/Region =(CN) China State =Beijing City/locality =Beijing 12. Click Next 13. Save the certificate request at desktop

19 14. 15. 16. 17. Click Next 2 times Click Finish A text file will be created at desktop Open the text file, certreq.

19 Click Next 2 times Click Finish A text file will be created at desktop Open the text file, certreq.txt, copy the content, which is started by -----BEGIN NEW CERTIFICATE REQUEST----- and ended by -----END NEW CERTIFICATE REQUEST Go to EJBCA public webpage\create Server Certificate 19. User name=ssl1 20. Password=foo123

20 Paste the request to the text area below 22. Select Result type as PKCS7 23. Click OK 24. A page of result will be shown.

21 Fetch SSL Certificate Copy the result and save it in a text file at desktop with a name of SSL1.text Change the text file extension from txt to cer so SSL1.text becomes SSL1.cer Go to Start\All Programs\Administrative tools\ Internet Information Services (IIS) Manager\ CLEAN2003 (local computer)\ Web Sites\right click Default Web Site \Properties\ Directory Security\Server Certificate

22 22 4. Click Next > 2 times Browse to SSL1.cer Click Next > 3 times Click Finish

$Go to Start\All Programs\Administrative tools\ Internet Information Services (IIS) Manager\ CLEAN2003 (local computer)\ Web Sites\right click Default Web Site \Properties\ Directory Security\Secure$

23 Configure IIS Go to Start\All Programs\Administrative tools\ Internet Information Services (IIS) Manager\ CLEAN2003 (local computer)\ Web Sites\right click Default Web Site \Properties\ Directory Security\Secure Communications\Edit Check require secure Channel (SSL) Check require 128-bit encryption Click OK Go to Authentication and access control \Edit Uncheck the anonymous access User name:= TESTING\Administrator Password=foo123 Check the Basic authentication (password is sent in clear text) Choose Yes to the warning Default Domain= testing.company.cn realm= testing.company.cn

24 Click OK 2 times

25 8 -- Test SSL 1. 2. Open Internet Explorer, go to http://testing.company.

25 Test SSL Open Internet Explorer, go to You will not be able to access the default webpage 3. Then try again with 4. Click Yes

26 Enter your account password, which you used to logon to server Then you will be able to access the default webpage 7. Notice that there is a lock sign 8. That means SSL is working at the bottom of the web page

EJBCA with GemSAFE Toolbox Part2 Sign. and Encrypt Email

EJBCA with GemSAFE Toolbox Part2 Sign and Encrypt Email 2 Introduction This document introduces the process of using EJBCA together with GemSAFE toolbox to encrypt and sign email. In short, there are 4