Certificates signed by own CA

Languages:

English

Introduction

This document describes how to create an own CA and make certifcates for all your servers signed by the own CA. Users can install the root certificate in the browsers or on mobile devices and then SSL access to all servers in your domain without getting certificate errors. The main purpose is the use in intranet web applications and enabling automatic push synchronization on mobile devices.

Setup

Download and unpack the scripts

cd /root
wget http://mirror.contribs.org/smeserver/contribs/michaelw/sme7/Certificates/ca_certs-0.0.1.tar.gz
tar xzf ca_certs-0.0.1.tar.gz
cd /root/ca_certs

Now open the openssl.cnf file in your editor and adjust the values of the following variables. Do not modfiy anything else.

0.organizationName_default              = My Company
organizationalUnitName_default          = IT Department
localityName_default                    = My City
stateOrProvinceName_default             = My State
countryName_default                     = DE
commonName_default                      = My Company Root CA
emailAddress_default                    = admin@mycompany.de

Generating the Root Certificate

Make the root certificate by running this script. Choose any name you like for COMPANY_NAME, e.g. your company name

./make_root_cert.sh COMPANY_NAME

You are asked to enter a pass phrase. Choose a strong one and memorize it. In the following you are asked to enter information. Just accept the defaults by hitting the enter key. The files private/COMPANY_NAME_ca_priv_key.pem and COMPANY_NAME_ca_cert.crt were created. Keep the private/COMPANY_NAME_ca_priv_key.pem safe and do never publish it! Note: The root certificate has a lifetime of 25 years set by the -days option inside the script.

Generating the Certificate Requests

Repeat the following for all your servers in your domain.

Make a certificate request for a host by running this script and pass the long hostname (FQHN) as the argument, e.g. sme7.mydomain.com

./make_cert_request.sh FQHN

You are asked to enter information. Just accept the defaults by hitting enter. The private key file FQHN.key and and the certificate request files FQHN.csr were created. Keep the private key safe!

Generating the Certificates

Repeat the following for all your servers in your domain. Replace FQHN and COMPANY_NAME by the values you have used in the steps above.

./make_cert.sh FQHN COMPANY_NAME

You are asked to enter the root key pass phrase. The new certificate FQHN.crt has been created and is ready for installation. Note: The root certificate has a lifetime of 10 years set by the -days option inside the script.

Installing the new Certificates on SME Servers

Copy the key and certificate pairs FQHN.key and FQHN.crt to the appropriate SME Servers to /home/e-smith/ssl.crt/FQHN.crt and /home/e-smith/ssl.key/FQHN.key. Then install the new certificate on every SME Server by running

config setprop modSSL crt /home/e-smith/ssl.crt/FQHN.crt
config setprop modSSL key /home/e-smith/ssl.key/FQHN.key
signal-event console-save

Installing the new Certificates on other Servers

Consult the server documentation on how to install a new certificate.

Making the Root Certificate available for Download

Copy the root certificates COMPANY_NAME_ca_cert.crt (PEM format) and COMPANY_NAME_ca_cert_der.crt (binary format) to /home/e-smith/files/ibays/Primary/html/ so that your users can download and install them in their browser or on their mobile device. Mobile devices may require the certificate in the binary DER format, browsers usually accept both formats.

---