EJBCA with GemSAFE Toolbox Part2 Sign. and Encrypt

Size: px

Start display at page:

Download "EJBCA with GemSAFE Toolbox Part2 Sign. and Encrypt Email"

Ellen Harper
10 years ago
Views:

1 EJBCA with GemSAFE Toolbox Part2 Sign and Encrypt

2 2 Introduction This document introduces the process of using EJBCA together with GemSAFE toolbox to encrypt and sign . In short, there are 4 compulsory settings for signing and encryption The end entity s must same with the account you are going to use In certificate profile, Digital Signature and Key Encipherment must be chosen in key usage; Protection must be chosen in Extended Key usage. In end entity profile, , Address in DN must be added. CA's certificate must be imported to local machine This document is a continuation form a document call EJBCA with GemSAFE Toolbox Part1 workstation logon. The forth setting, importing CA's certificate to local machine had been done in previous document. If you want to skip the previous document and directly get started from this, don't forget to import the CA's certificate to local machine yourselves.

3 3 Table of Content EJBCA with GemSAFE Toolbox Part2 Sign and Encrypt Introduction...2 Table of Content Configure EJBCA Create Certificate Profile Create End Entity Profile " " Add " Sender" End Entity Enroll Certificate to GemSAFE Smartcard Configure Server Add Server as a Server Add a New Account Configure Microsoft Outlook 2003 for Sending Encrypted and Signed s...20

3 -- Add "EmailSender" End Entity...14 1.4 -- Enroll Certificate to GemSAFE Smartcard...15 2 -- Configure Server...16 2.1. -- Add Server as a Email Server.

4 Configure EJBCA

5 Create Certificate Profile On server, go to EJBCA Administration GUI Click Edit Certificate Profiles Type " " in the text box under Add Profile. Click Add a) Choose under Current Certificate Profiles b) Click Edit Certificate Profile c) Set certificate profile s parameters i. Under "Key Usage" select "Digital Signatures" and Key Encipherment ii. Check "Use Extended Key Usage" iii. Under "Extended Key Usage" select " Protection " iv. Under "Available CAs" select only "GS_SCL_CA_v1" Leave all other setting by default, click save The following is the screen capture of the settings

6 6

7 7

8 8

9 9

10 Create End Entity Profile " " On server, go to EJBCA Administration GUI Click Edit End Entity Profiles Type " " in the text box under Add Profile. Click Add a) Choose under Current End Entity Profiles b) Click Edit End Endtity Profile c) Set end entity profile s parameters i. Under "Subject DN" fields, add , Address in DN ii. Under , Address in DN, check Required iii. Under Default certificate profile select iv. Under Available certificate profiles select v. Under Default CA select GS_SCL_CA_v1 vi. Under "Available CAs" select only "GS_SCL_CA_v1" Leave all other setting by default, click save The following is the screen capture of the settings

11 11

12 12

13 13

14 1.3 -- Add "EmailSender" End Entity 1. 2. 3. 4. 5. 6. 7. 8. 9.

14 Add " Sender" End Entity On server, go to EJBCA Administration GUI Click Add End Entity Under End Entity Profile choose GS SmartCardLogon User Name= Sender01 Password= foo123 Confirm Password= foo123 CN, Common Name= Sender01 MS UPN, User Principal Name = [email protected] The following is the screen capture of the settings 10. Leave all other setting by default, click Add End Entity

User Name= EmailSender01 Password= foo123 Confirm Password= foo123 CN, Common Name= EmailSender01 MS UPN, User

15 Enroll Certificate to GemSAFE Smartcard On work station, open Internet Explorer Go to EJBCA's Public Web Pages, plug in GemSAFE token Click Create Browser Certificate Username: = Sender01 Password: =foo123 Click OK Another webpage will be shown Under Options, choose Provider as Gemplus GemSAFE Card CSP Click OK A potential script violation warning may be shown, Click Yes Enter smart card s PIN Click OK A potential script violation warning may be shown, Click Yes Click OK

cn:8080/ejbca/ plug in GemSAFE token Click Create Browser Certificate Username: =EmailSender01 Password: =foo123 Click OK Another webpage will

16 Configure Server

17 Add Server as a Server Go to Domain Controller\start\Manage Your Server\Add or Remove a Role\Click Next \ Chose Mail server (POP3, SMTP) 3. Click Next

$Your Server\Add or Remove a Role\Click Next$

18 4. In E-mail domain name: field, input testing.company.cn 5. 6.

18 18 4. In domain name: field, input testing.company.cn Click Next 2 times You may be prompted to locate the Windows Server 2003 image or CD location 7. Click Finish

$At server, go to Start\Administrative Tools\POP3 Service Click CLEAN2003 node\click testing.company.$

19 Add a New Account At server, go to Start\Administrative Tools\POP3 Service Click CLEAN2003 node\click testing.company.cn \ Add MailBox Maillbox Name: Sender01 Password: foo123@ Confirm Password: foo123@ Click OK Click OK

$CLEAN2003 node\click testing.company.$

20 Configure Microsoft Outlook 2003 for Sending Encrypted and Signed s

21 Install Microsoft Outlook 2003 on Workstation Add account Sender01, to Microsoft Outlook 2003 a) At workstation, open Microsoft Outlook 2003\ tools\ Accounts b) Click Next

$22 c) d) e) f) g) h) i) j) Choose POP3 \Click Next > Your Name = EmailSender01 E-mail Address = emailsender01@testing.company.$

22 22 c) d) e) f) g) h) i) j) Choose POP3 \Click Next > Your Name = Sender01 Address = [email protected] Incoming mail Server (POP3): = testing.company.cn Outgoing mail Serve (SMTP): = testing.company.cn Username= sender01 Password = foo123@ Check logon using Secure Password Authentication (SPA)

23 23 k) Click Test Account Settings l) Click Close m) Click Next > n) Click Finish

$24 a) b) c) In Microsoft Outlook 2003, Tools\ Options \ Security Check Encrypt contents and attachments for outgoing$

24 24 a) b) c) In Microsoft Outlook 2003, Tools\ Options \ Security Check Encrypt contents and attachments for outgoing messages Check Add digital signature to outgoing messages d) e) f) Click Setting Click Choose Select the Sender01 s certificate

25 25 g) h) 3. Click OK Select Hash Algorithm: as MD5 i) Click OK j) Click Apply k) Click OK Now you can use Microsoft Outlook 2003 to send a signed to yourself (for illustration purpose)

26 4. When you received a signed email, you

26 26 4. When you received a signed , you can reply with a signed and encrypted

EJBCA with GemSAFE Toolbox Part1 Workstation Logon

EJBCA with GemSAFE Toolbox Part1 Workstation Logon 2 Introduction This document describes installation of EJBCA3.6.0, starting from a clean Windows Server 2003 and a clean Window XP Professional. In this