Certificates and SSL

Transcription

1 SE425: Communication and Information Security Recitation 12 Semester June 2015 Certificates and SSL In this recitation we ll see how to use digital certificates for signing and how to use SSL as part of a.net application. 1 Using Certificates in There are a number of certification authorities that let you create free digital certificates for signing and encryption. One company that offers that service is Comodo. The digital certificate that you get from them (for free) just verifies that the came from the address you provide to them. There is no personal name in the certificate since they have no way of telling what your name really is. Once you have a certificate from Comodo you can install it in your browser or client to sign and encrypt s. 1.1 What to do 1. Open your browser (preferably on your personal computer) and navigate to com/products/frontpage?area=secure certificate 2. Fill in the information in the form and provide an address that you can use with a non-web client. 3. Once you enter in your information, Comodo will send you an which looks like the figure below: 4. Once you open the and click on the top button you will be brought to a page which will install the public key certificate in your browser. You can see if it was successful (using Firefox) by opening the Options- Advanced- Certificates- View Certificates dialog. 1

2 5. After you install the certificate, the dialog should show at least one line that looks like the figure below: 6. The certificate is now in your browser. To move it to your application, you first need to export it. You can do so by clicking on the Backup... button on the dialog box. That will enable you to store the certificate on your computer. The Backup step asks for a password to encrypt the certificate on export. Choose a good one. 7. Next, open your client and the account you want to attach the certificate to. The example below is for Thunderbird: 8. Choose to use the certificate as a signing certificate by selecting to import the certificate you exported. Once you enter the password for it, you will see the new certificate added to the account: 2

3 9. Once the certificate is imported you can add it to the account by selecting it using the Select button: 10. You can then use it to sign s from the account by adding a digital signature to the 3

4 2 Creating Your Own Certificates.NET offers a tool to create your own certificates which can be stored in the local certificate store in Windows. The tool to create a certificate is called makecert.exe and it can be found in the Windows SDK directory. In Windows 7 it can be found in: C:\ProgramFiles\MicrosoftSDKs\Windows\v6.0A\Bin. You may need to install the Windows SDKs on your computer if you don t have them already installed. The directory may be different in Windows 8. We can view the local certificates on the computer using the Microsoft Management Console which has a Certificates snap-in tool. The tool is designed to create code signing certificates, but you can use them for other purposes as well. Don t try to use them for SSL servers since they won t pass any browser s verification steps. The following command creates a new certificate using makecert with some configuration parameters: makecert -n "CN=Michael J. May ;O=Kinneret College on the Sea of Galilee;OU=Achi Racov Engineering School" -pe -sr currentuser -ss My -cy end -h 0 -a sha1 -$ individual The flags set the following parameters: -n The identity of the entity in the certificate is Michael J. May of the organization called Kinneret College on the Sea of Galilee in the organizational unit called Achi Racov Engineering School -pe The private key is included in the certificate and can be exported. -sr The certificate will stored in the location provided. The value currentuser is the default value and it puts it in the certificates installed for the user. You can also put localmachine to put it at the machine level. -ss The certificate store into which the certificate will be put. The My certificate store is the default one for the user. -cy Indicates the certificate is an end entity and so can t sign on others. You could also put authority to allow it. -h Limits the number of nodes on the tree below the node. Putting 0 means no one can be below. -a The hash algorithm used. The default for makecert is MD5 which has known issues, so I used sha1. 4

5 -$ Indicates what kind of authority the certificate grants. Here is grants only authority as an individual code signer. You could also put commercial to declare yourself a commercial publisher. By examining the certificate issued, we can see how the field values are stored in the certificate: We could also add the -r parameter to make it a self signed certificate and get the following resulting certificate: 5

6 As with the certificates, the ones in the computer s certificate store can be exported and viewed externally. They can also be used to manually set up SSL channels using.net channels and streams. See the documentation for the SslStream class in.net. 6