PKI - Revision history

NickPGSmith: /* Root CA */

2025-02-15T18:42:35Z

Root CA

← Older revision		Revision as of 18:42, 15 February 2025
Line 155:		Line 155:
	# openssl ecparam -genkey -out private/ca.key.pem -name secp384r1		# openssl ecparam -genkey -out private/ca.key.pem -name secp384r1

	~~set~~ correct permissions:		Other curves available: secp256r1 / secp521r1

			Set correct permissions:
	# chmod 400 private/ca.key.pem		# chmod 400 private/ca.key.pem

2024-09-12T15:10:16Z

OpenSSL Useful Commands

← Older revision		Revision as of 15:10, 12 September 2024
Line 130:		Line 130:
	* secp521r1 : NIST/SECG curve over a 521 bit prime field (highest security, lower compatibility)		* secp521r1 : NIST/SECG curve over a 521 bit prime field (highest security, lower compatibility)
	* prime256v1 : X9.62/SECG curve over a 256 bit prime field (good compatibility)		* prime256v1 : X9.62/SECG curve over a 256 bit prime field (good compatibility)

			Nmap can show available ciphers:
			nmap --script ssl-enum-ciphers -p 443 localhost

	== OpenSSL CA Setup ==		== OpenSSL CA Setup ==

2024-05-14T06:15:59Z

Let's Encrypt

← Older revision		Revision as of 06:15, 14 May 2024
Line 418:		Line 418:

	A systemd timer is installed for auto-renewal:		A systemd timer is installed for auto-renewal:
	* /etc/systemd/system/snap.certbot.renew.timer		* /etc/systemd/system/snap.certbot.renew.timer

2024-05-14T06:15:38Z

Let's Encrypt

← Older revision		Revision as of 06:15, 14 May 2024
Line 413:		Line 413:

	This will show details including the installed paths, eg:		This will show details including the installed paths, eg:
	Certificate Path: /etc/letsencrypt/live/www.example.com/fullchain.pem		* Expiry Date (validity is 89 days)
	Private Key Path: /etc/letsencrypt/live/www.example.com/privkey.pem		* Certificate Path: /etc/letsencrypt/live/www.example.com/fullchain.pem
			* Private Key Path: /etc/letsencrypt/live/www.example.com/privkey.pem

			A systemd timer is installed for auto-renewal:
			* /etc/systemd/system/snap.certbot.renew.timer

2024-05-14T06:08:07Z

Let's Encrypt

← Older revision		Revision as of 06:08, 14 May 2024
Line 395:		Line 395:
	core20 20240227 2264 latest/stable canonical✓ base		core20 20240227 2264 latest/stable canonical✓ base
	snapd 2.62 21465 latest/stable canonical✓ snapd		snapd 2.62 21465 latest/stable canonical✓ snapd

			Certbot will authenticate (to prove you own the domain) and optionally install the certicate. See [https://eff-certbot.readthedocs.io/en/latest/using.html Certbot Docs] for more information.

	Get certificate:		Get certificate:
	certbot certonly --~~apache~~		certbot certonly -d www.example.com -d example.com

			...
			3: Saves the necessary validation files to a .well-known/acme-challenge/
			directory within the nominated webroot path. A seperate HTTP server must be
			running and serving files from the webroot path. HTTP challenge only (wildcards
			not supported). (webroot)
			...
			Select webroot: /var/www/html

	Show certificates:		Show certificates:
	certbot certificates		certbot certificates

			This will show details including the installed paths, eg:
			Certificate Path: /etc/letsencrypt/live/www.example.com/fullchain.pem
			Private Key Path: /etc/letsencrypt/live/www.example.com/privkey.pem

2024-05-14T05:55:37Z

Let's Encrypt

2024-05-14T05:49:48Z

← Older revision		Revision as of 05:49, 14 May 2024
Line 376:		Line 376:

	TBC		TBC

			== Let's Encrypt ==

			Install snapd:
			dnf install snapd
			ln -s /var/lib/snapd/snap /snap
			systemctl enable snapd
			systemctl start snapd

			Install certbot:
			snap install --classic certbot
			ln -s /snap/bin/certbot /usr/local/bin/certbot

			Check installation:
			root@svr1:/# snap list
			Name Version Rev Tracking Publisher Notes
			certbot 2.10.0 3700 latest/stable certbot-eff✓ classic
			core20 20240227 2264 latest/stable canonical✓ base
			snapd 2.62 21465 latest/stable canonical✓ snapd

			Get certificate:
			certbot certonly --apache

2024-05-08T04:53:41Z

6 revisions imported

← Older revision	Revision as of 04:53, 8 May 2024
(No difference)

2023-11-28T17:42:45Z

← Older revision		Revision as of 17:42, 28 November 2023
Line 119:		Line 119:

	Connect to a server, grab certificate and check against CA bundle:		Connect to a server, grab certificate and check against CA bundle:
	openssl s_client -~~showcert~~ -connect 192.168.0.1:443 -CAfile ca.pem		openssl s_client -showcerts -connect 192.168.0.1:443 -CAfile ca.pem
	which will show the certificate chain, SSL handshake, negotiated protocol version and cypher. If all goes well, a 0 return code will be given. Code 19 means a self-signed cert has been reached, which it doesn't trust (typically the CA cert is not in the CA bundle specified).		which will show the certificate chain, SSL handshake, negotiated protocol version and cypher. If all goes well, a 0 return code will be given. Code 19 means a self-signed cert has been reached, which it doesn't trust (typically the CA cert is not in the CA bundle specified).

2023-10-02T09:04:21Z

OpenSSL Useful Commands

← Older revision		Revision as of 09:04, 2 October 2023
Line 119:		Line 119:

	Connect to a server, grab certificate and check against CA bundle:		Connect to a server, grab certificate and check against CA bundle:
	openssl s_client -connect 192.168.0.1:443 -CAfile ca.pem		openssl s_client -showcert -connect 192.168.0.1:443 -CAfile ca.pem
	which will show the certificate chain, SSL handshake, negotiated protocol version and cypher. If all goes well, a 0 return code will be given. Code 19 means a self-signed cert has been reached, which it doesn't trust (typically the CA cert is not in the CA bundle specified).		which will show the certificate chain, SSL handshake, negotiated protocol version and cypher. If all goes well, a 0 return code will be given. Code 19 means a self-signed cert has been reached, which it doesn't trust (typically the CA cert is not in the CA bundle specified).