Tag Archives: ocsp

Creating a CA using OpenSSL – with OCSP

SSL Certificates are a source of huge amounts of confusion. There are two things that a SSL session will provide. The first is encryption, which can be provided with “self signed” certificates. The second, and arguably the more important is authentication of the remote server. This is managed by “Certification Authorities”. Web Browsers will have a set of known CAs that are trusted, and any certificate signed by them is therefore also trusted. Obviously if a CA has had a security breach then all bets are off.

Within an organisation it is usually preferable for NON PUBLIC facing sites and services to use ‘self signed’ or internal CA signed certificates. The later is usually more sensible, however it comes with the issue of more administrative time is required, and also that all clients must trust this CA.

There are various different ways of creating a CA, Windows Server 2003 and above come with their own CA software, and most UNIX/Linux distributions have OpenSSL available.

In this guide I’m going to walk through the creation of a CA using OpenSSL. I’m also going to look at enabling additional features such as OSCP (a way of clients confirming if a certificate is still valid) and go over how to create “Server Alternative Name” certificates (also known as UC or SAN certs, allowing multiple hostnames/domainnames to exist on the same cert).

One key thing to remember here is security of the CA. You must ensure that no unauthorized access is permitted to the CA, as if someone has been able to gain this, they will have access to issue certificates.

I’m also going to ensure that we setup OCSP, which is a way of clients checking to see that certificates are still valid and not revoked.

Prerequisites

Before we start we need to have the following:

  • A Linux Server with openssl installed (for this example I’m going to be using CentOS 6.4, however any linux distribution should work)
  • A Domain name (in this example I’m going to use test.local)

Configure OpenSSL

On a CentOS/RedHat system there is already a basic openssl.cnf file created, that the scripts for managing a CA already take into account.  /etc/pki/tls/openssl.cnf

Open this up in which ever editor you like and do the following:

  • Locate  countryName_default = XX and change the XX to which ever country code you are in, for example the United Kingdom would be GB
  • Locate  #stateOrProvinceName_default = Default Province and edit this line so there is no # at the start, and that Default Province now is set to our State/Proviince/County/City
  • Locate  localityName_default = Default City and edit this to be your City
  • Locate 0.organizationName_default  and edit this to be your City

At this point we’ve edited the config so that for any new requests you won’t have to type these in!

Whilst still in the Text Editor we need to setup the OCSP side of things.

  • Locate the  [ usr_cert ] section and add 

    In this example I’m going to put this on the CA, but this is *NOT* a good idea from a security perspective. You want the CA to have as little (if indeed any) access from the outside.
  • We also need to create the OCSP ‘extensions’ section. Add this to the end of the file

     

Create the CA

We’re going to use the OpenSSL CA script to do this.

  • Change directory to  /etc/pki/tls/misc 
  • Run the CA command:  ./CA -newca 
  • Whilst Running it you will be asked
              • File name : Just hit enter here
              • PEM Passphrase  : this is the password you will use for the CA. Make sure it’s secure!
              • Country Name : Hit enter here
              • State or Province Name : Hit enter here
              • Locality Name (eg, city) : Hit enter here
              • Organization Name (eg, company) : Hit enter here
              • Organizational Unit Name : Hit enter here
              • Common Name (eg, your name or your server's hostname) : For this its generally considered best to set this to ca.domain, so in this case ca.test.local
              • Email Address : Hit enter here
              • A challenge password : Hit Enter here
              • An optional company name : Hit enter here
              • Enter pass phrase for /etc/pki/CA/private/./cakey.pem :: Enter the CA password here

The end output should look similar to

 

At this point you have a CA setup and ready to go. You will need to ensure that the CA public certificate is installed on the browsers / devices that you will be using. This can be downloaded using a SCP client from  /etc/pki/CA/cacert.pem

Creating a OCSP signing certificate

In order to host an OCSP server, we have to generate a OCSP signing certificate. If you’re going to have multiple OCSP servers, you may want to have multiple certificates.

We’re going to create a directory, and a request for the certificate

At this point we now need to sign the request and make the certificate

You will be asked for

  • CA Passphrase
  • Sign the certificate? [y/n]: Say yes to this
  • 1 out of 1 certificate requests certified, commit? Say yes to this as well

Start OCSP server

At this point we now also need to run the OCSP server. Be aware that this is going to run as root in this example, which you should *NOT* do. You will want to ensure permissions are done in a way that a normal user, I’m not going to cover this at the moment though. Start the server with the following

 

 Issuing a Certificate

Now that you’ve got a working CA, you can sign any certificate requests. There are multiple ways of creating these, some software will provide you a CSR, but in this example I’m going to do this all on the CA its self (don’t do this in production!)

  • Change directory to /etc/pki/tls/misc
  • Run the CA command: ./CA -newreq

This will give a result similar to below

We now need to sign the certificate

  • Run the CA command 

This will give a result similar to

The certificate now exists and can be seen in newcert.pem (and the key in newkey.pem)

Checking OCSP status

We can now check to see if the above certificate is valid via OCSP:

openssl ocsp -CAfile /etc/pki/CA/cacert.pem -issuer /etc/pki/CA/cacert.pem -cert newcert.pem -url http://127.0.0.1:8888 -resp_text

This will return an address similar to below:

 Revoking a certificate.

Oh no! The certificate above has been compromised. We need to revoke it. This isn’t as difficult as you may think. We have a copy of all of the certificates on the CA. If we look at the certificate serial number (c5:07:3c:dc:c5:8a:cb:ad in this case) this file should exist in  /etc/pki/CA/newcerts/ To revoke you need to

  • Revoke the certificate  openssl ca -revoke /etc/pki/CA/newcerts/C5073CDCC58ACBAD.pem 
  • Verify that the certifcate is revoked  openssl ocsp -CAfile /etc/pki/CA/cacert.pem -issuer /etc/pki/CA/cacert.pem -cert /etc/pki/CA/newcerts/C5073CDCC58ACBAD.pem -url http://127.0.0.1:8888 -resp_text