Generating SSL certs with ACF
You are in need of creating certificate for remote persons. You might use something like openvpn or racoon for your VPN services. But wouldn't it be nice to have some sort of way to manage and view all the certs you have given to everyone? Revoke the certs? Review the certificate before you issue it? Alpine, via ACF, has a nice web interface to use for this sort of job...
This will somewhat guide you through the process of creating this type of server. It is suggested to not host this on your VPN gateway, but use another machine to generate your certificates.
Link below to the standard document.
Install and Configure ACF
Run the following command: This will install the web front end to Alpine Linux, called ACF.
Browse to your computer https://ipaddr/
Login as root.
Click on the User Management tab and create yourself an account.
From the navigation bar on the left, under the Applications section, click the Certificate Authority link.
If you already have a CA that you would like to have the web interface manage you can upload it from the Status page (as a pfx).
From the Status tab, Click Configure(to remove most of the error messages).
If you do not have a CA, To generate a new CA certificate: Click the Edit Defaults tab. Input the Items that will be needed for the CA and any other certs generated from it then Click Save. Click the Status tab. Input values for the input boxes to generate a CA and click Generate.
Generate a certificate with ACF
- Country Name (2 letter abbreviation)
- Locality Name (e.g. city)
- Organization Name
- Common Name (eg, the certificate CN)
- Email Address
- Multiple Organizational Unit Name (eg, division)
- Certificate Type
A box has been set aside for adding Additional x509 Extensions formatted the same as if you were to fill out a section directly in openssl.cnf. Section would be [v3_req]
You could put in here:
- subjectAltName ="IP:192.168.1.1"
- subjectAltName ="DNS:192.168.1.10"
Here is also where you would specify the CRL / OCSP distribution point, from where clients can query information:
Once this form has been filled out and the password entered click submit.
Go to the View tab after you have the request form submitted. The view tab will show you pending requests for certificates. Also available from this tab are already approved requests (generated certs), revoked certs, and the CRL.
For a Pending request, make sure to review the cert before approving it. Once you have verified that all the information is correct, with no mis-types or spelling mistakes, Approve the request.
The file that will be generated can be downloaded from the ACF. Use the command lines below to extract the pkcs12 file into its part to begin using it.
Extract PFX certificate
To get the CA CERT
To get the Private Key
To get the Certificate
Display the cert or key readable/text format
To get the CA Chain in one file, and Certificate and Private key in another:(For lighttpd for instance)
Since this file contains the key without passsword protection, make sure to set restrictive permissions on this file.
OpenSSL command line to create your CA
The following command will need a password. Make sure to remember this.
Edits to /etc/ssl/openssl-ca-acf.cnf
Via the expert tab on ACF edit the openssl-ca-acf.cnf file. Something like subjectAltName can be added to be used by the certificates that you generate.
3.subjectAltName = Assigned IP Address
3.subjectAltName_default = 192.168.1.1/32