From 064574425b38832f94e51fe31a1f6293ad8ac604 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Fri, 20 Jun 2008 11:53:05 +0200 Subject: improved TLS doc also changed samples to 2048 bit keys, because 1024 will soon no longer be considered secure. --- doc/tls_cert_ca.html | 38 ++++++++++++++++++++------------------ doc/tls_cert_machine.html | 43 +++++++++++++++++++++++-------------------- doc/tls_cert_scenario.html | 3 +-- 3 files changed, 44 insertions(+), 40 deletions(-) (limited to 'doc') diff --git a/doc/tls_cert_ca.html b/doc/tls_cert_ca.html index efe34c85..7427bb03 100644 --- a/doc/tls_cert_ca.html +++ b/doc/tls_cert_ca.html @@ -68,19 +68,21 @@ sign other certificates.

Sample Screen Session

+

Text in red is user input. Please note that for some questions, there is no +user input given. This means the default was accepted by simply pressing the +enter key. 

-[root@rgf9dev sample]# certtool --generate-privkey --outfile ca-key.pem
-Generating a 1024 bit RSA private key...
-[root@rgf9dev sample]# certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca.pem
-[root@rgf9dev sample]# certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca.pem
+[root@rgf9dev sample]# certtool --generate-privkey --outfile ca-key.pem --bits 2048
+Generating a 2048 bit RSA private key...
+[root@rgf9dev sample]# certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca.pem
 Generating a self signed certificate...
 Please enter the details of the certificate's distinguished name. Just press enter to ignore a field.
-Country name (2 chars): US
-Organization name: SomeOrg
-Organizational unit name: SomeOU
-Locality name: Somewhere
-State or province name: CA
-Common name: someName (not necessarily DNS!)
+Country name (2 chars): US
+Organization name: SomeOrg
+Organizational unit name: SomeOU
+Locality name: Somewhere
+State or province name: CA
+Common name: someName (not necessarily DNS!)
 UID: 
 This field should not be used in new certificates.
 E-mail: 
@@ -88,16 +90,16 @@ Enter the certificate's serial number (decimal):
 
 
 Activation/Expiration time.
-The certificate will expire in (days): 3650
+The certificate will expire in (days): 3650
 
 
 Extensions.
-Does the certificate belong to an authority? (Y/N): y
+Does the certificate belong to an authority? (Y/N): y
 Path length constraint (decimal, -1 for no constraint): 
 Is this a TLS web client certificate? (Y/N): 
 Is this also a TLS web server certificate? (Y/N): 
-Enter the e-mail of the subject of the certificate: someone@example.net
-Will the certificate be used to sign other certificates? (Y/N): y
+Enter the e-mail of the subject of the certificate: someone@example.net
+Will the certificate be used to sign other certificates? (Y/N): y
 Will the certificate be used to sign CRLs? (Y/N): 
 Will the certificate be used to sign code? (Y/N): 
 Will the certificate be used to sign OCSP requests? (Y/N): 
@@ -111,7 +113,7 @@ X.509 Certificate Information:
 		Not After: Sun Jun 17 10:35:25 UTC 2018
 	Subject: C=US,O=SomeOrg,OU=SomeOU,L=Somewhere,ST=CA,CN=someName (not necessarily DNS!)
 	Subject Public Key Algorithm: RSA
-		Modulus (bits 1024):
+		Modulus (bits 2048):
 			d9:9c:82:46:24:7f:34:8f:60:cf:05:77:71:82:61:66
 			05:13:28:06:7a:70:41:bf:32:85:12:5c:25:a7:1a:5a
 			28:11:02:1a:78:c1:da:34:ee:b4:7e:12:9b:81:24:70
@@ -135,12 +137,12 @@ Other Information:
 	Public Key Id:
 		fbfe968d10a73ae5b70d7b434886c8f872997b89
 
-Is the above information ok? (Y/N): y
+Is the above information ok? (Y/N): y
 
 
 Signing certificate...
-[root@rgf9dev sample]# chmod 400 ca-key.pem
-[root@rgf9dev sample]# ls -l
+[root@rgf9dev sample]# chmod 400 ca-key.pem
+[root@rgf9dev sample]# ls -l
 total 8
 -r-------- 1 root root  887 2008-06-19 12:33 ca-key.pem
 -rw-r--r-- 1 root root 1029 2008-06-19 12:36 ca.pem
diff --git a/doc/tls_cert_machine.html b/doc/tls_cert_machine.html
index f7868caa..0d2955f7 100644
--- a/doc/tls_cert_machine.html
+++ b/doc/tls_cert_machine.html
@@ -53,20 +53,23 @@ of this document.
 able to obtain that private key can imporsonate as the machine to which it belongs, thus
 breaching your security.
 
Sample Screen Session

+
Text in red is user input. Please note that for some questions, there is no
+user input given. This means the default was accepted by simply pressing the 
+enter key.
 
-[root@rgf9dev sample]# certtool --generate-privkey --outfile key.pem
-Generating a 1024 bit RSA private key...
-[root@rgf9dev sample]# certtool --generate-request --load-privkey key.pem --outfile request.pem
+[root@rgf9dev sample]# certtool --generate-privkey --outfile key.pem --bits 2048
+Generating a 2048 bit RSA private key...
+[root@rgf9dev sample]# certtool --generate-request --load-privkey key.pem --outfile request.pem
 Generating a PKCS #10 certificate request...
-Country name (2 chars): US
-Organization name: SomeOrg
-Organizational unit name: SomeOU
-Locality name: Somewhere
-State or province name: CA
-Common name: machine.example.net
+Country name (2 chars): US
+Organization name: SomeOrg
+Organizational unit name: SomeOU
+Locality name: Somewhere
+State or province name: CA
+Common name: machine.example.net
 UID: 
 Enter a challenge password: 
-[root@rgf9dev sample]# certtool --generate-certificate --load-request request.pem --outfile cert.pem --load-ca-certificate ca.pem --load-ca-privkey ca-key.pem
+[root@rgf9dev sample]# certtool --generate-certificate --load-request request.pem --outfile cert.pem --load-ca-certificate ca.pem --load-ca-privkey ca-key.pem
 Generating a signed certificate...
 Enter the certificate's serial number (decimal): 
 
@@ -76,10 +79,10 @@ The certificate will expire in (days): 1000
 
 
 Extensions.
-Does the certificate belong to an authority? (Y/N): n
-Is this a TLS web client certificate? (Y/N): y
-Is this also a TLS web server certificate? (Y/N): y
-Enter the dnsName of the subject of the certificate: machine.example.net
+Does the certificate belong to an authority? (Y/N): n
+Is this a TLS web client certificate? (Y/N): y
+Is this also a TLS web server certificate? (Y/N): y
+Enter the dnsName of the subject of the certificate: machine.example.net
 Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (Y/N): 
 Will the certificate be used for encryption (RSA ciphersuites)? (Y/N): 
 X.509 Certificate Information:
@@ -90,7 +93,7 @@ X.509 Certificate Information:
 		Not After: Wed Mar 16 10:42:57 UTC 2011
 	Subject: C=US,O=SomeOrg,OU=SomeOU,L=Somewhere,ST=CA,CN=machine.example.net
 	Subject Public Key Algorithm: RSA
-		Modulus (bits 1024):
+		Modulus (bits 2048):
 			b2:4e:5b:a9:48:1e:ff:2e:73:a1:33:ee:d8:a2:af:ae
 			2f:23:76:91:b8:39:94:00:23:f2:6f:25:ad:c9:6a:ab
 			2d:e6:f3:62:d8:3e:6e:8a:d6:1e:3f:72:e5:d8:b9:e0
@@ -117,20 +120,20 @@ Other Information:
 	Public Key Id:
 		0ce1c3dbd19d31fa035b07afe2e0ef22d90b28ac
 
-Is the above information ok? (Y/N): y
+Is the above information ok? (Y/N): y
 
 
 Signing certificate...
-[root@rgf9dev sample]# rm -f request.pem
-[root@rgf9dev sample]# ls -l
+[root@rgf9dev sample]# rm -f request.pem
+[root@rgf9dev sample]# ls -l
 total 16
 -r-------- 1 root root  887 2008-06-19 12:33 ca-key.pem
 -rw-r--r-- 1 root root 1029 2008-06-19 12:36 ca.pem
 -rw-r--r-- 1 root root 1074 2008-06-19 12:43 cert.pem
 -rw-r--r-- 1 root root  887 2008-06-19 12:40 key.pem
 [root@rgf9dev sample]# # it may be a good idea to rename the files to indicate where they belong to
-[root@rgf9dev sample]# mv cert.pem machine-cert.pem
-[root@rgf9dev sample]# mv key.pem machine-key.pem
+[root@rgf9dev sample]# mv cert.pem machine-cert.pem
+[root@rgf9dev sample]# mv key.pem machine-key.pem
 [root@rgf9dev sample]# 
 

 
Distributing Files

diff --git a/doc/tls_cert_scenario.html b/doc/tls_cert_scenario.html
index dced5393..7973532b 100644
--- a/doc/tls_cert_scenario.html
+++ b/doc/tls_cert_scenario.html
@@ -42,8 +42,7 @@ hav decided to use ada.example.net because it is in the same local network
 segment as the router and so we enjoy TLS' security benefits for forwarding the 
 router messages inside the corporate network. All systems (except the router) use
 rsyslog as the syslog software.

-

-

+

 
Please note that the CA must not necessarily be connected to the rest of the
 network. Actually, it may be considered a security plus if it is not. If the CA
 is reachable via the regular network, it should be sufficiently secured (firewal
-- 
cgit