Generating SSL certs with ACF - Revision history

Sertonix: replace /etc/init.d with rc-service

2023-11-17T10:10:11Z

replace /etc/init.d with rc-service

← Older revision		Revision as of 10:10, 17 November 2023
Line 107:		Line 107:

	Restart mini_httpd		Restart mini_httpd
	{{Cmd\|~~/etc/init.d/~~mini_httpd restart}}		{{Cmd\|rc-service mini_httpd restart}}

	===Generating server and client certs for OpenVPN===		===Generating server and client certs for OpenVPN===

Zcrayfish: /* Generate a certificate with ACF */ Remove a hyperlink to hypothetical URL. Use RFC2606 (section 3) domain.

2021-12-20T18:39:03Z

Generate a certificate with ACF: Remove a hyperlink to hypothetical URL. Use RFC2606 (section 3) domain.

← Older revision		Revision as of 18:39, 20 December 2021
Line 57:		Line 57:

	Here is also where you would specify the CRL / OCSP distribution point, from where clients can query information:		Here is also where you would specify the CRL / OCSP distribution point, from where clients can query information:
	* crlDistributionPoints=URI:http://~~whatever~~.com/~~whatever~~.crl		* crlDistributionPoints=URI:<nowiki>http://example.com/example.crl</nowiki>

	Once the form is filled out and the password entered, click submit.		Once the form is filled out and the password entered, click submit.

Zcrayfish: /* Install and Configure ACF */ Remove hyperlink to hypothetical URL.

2021-12-20T18:36:17Z

Install and Configure ACF: Remove hyperlink to hypothetical URL.

← Older revision		Revision as of 18:36, 20 December 2021
Line 20:		Line 20:
	{{Cmd\|apk add acf-openssl}}		{{Cmd\|apk add acf-openssl}}

	Browse to your computer https://ipaddr/		Browse to your computer <nowiki>https://ipaddr/</nowiki>

	Log in as root.		Log in as root.

Bt129: /* Edits to /etc/ssl/openssl-ca-acf.cnf */

2021-07-26T09:34:57Z

Edits to /etc/ssl/openssl-ca-acf.cnf

← Older revision		Revision as of 09:34, 26 July 2021
Line 139:		Line 139:

	===Edits to /etc/ssl/openssl-ca-acf.cnf ===		===Edits to /etc/ssl/openssl-ca-acf.cnf ===
	Via the expert tab on ACF edit the openssl-ca-acf.cnf file. Something like subjectAltName can be added to be used by the certificates ~~that~~ you generate.		Via the expert tab on ACF, edit the openssl-ca-acf.cnf file. Something like subjectAltName can be added to be used by the certificates you generate.

	<tt>3.subjectAltName = Assigned IP Address </tt>		<tt>3.subjectAltName = Assigned IP Address </tt>

Bt129: /* OpenSSL command line to create your CA */

2021-07-26T09:34:13Z

OpenSSL command line to create your CA

← Older revision		Revision as of 09:34, 26 July 2021
Line 126:		Line 126:
	==Extras==		==Extras==
	===OpenSSL command line to create your CA ===		===OpenSSL command line to create your CA ===
	The following command will need a password. Make sure to remember ~~this~~.		The following command will need a password. Make sure to remember it.

	{{Cmd\|openssl genrsa -des3 -out server.key 2048}}		{{Cmd\|openssl genrsa -des3 -out server.key 2048}}

Bt129: /* Generating server and client certs for OpenVPN */

2021-07-26T09:32:51Z

Generating server and client certs for OpenVPN

← Older revision		Revision as of 09:32, 26 July 2021
Line 116:		Line 116:
	Copy the server certificate pfx to the OpenVPN server and extract the certificate using the commands above. Configuration of the OpenVPN server is beyond the scope here.		Copy the server certificate pfx to the OpenVPN server and extract the certificate using the commands above. Configuration of the OpenVPN server is beyond the scope here.

	Create an ACF user account on the Certificate Authority server for each OpenVPN user. From the navigation bar, click on User Management under System. Click on Create. Create a user with CERT_REQUESTER role for each user. You ~~could~~ set the user Home to /openssl/openssl/read to default to showing that user's certificates.		Create an ACF user account on the Certificate Authority server for each OpenVPN user. From the navigation bar, click on User Management under System. Click on Create. Create a user with CERT_REQUESTER role for each user. You can set the user Home directory to /openssl/openssl/read to default to showing that user's certificates.

	Each user can request ~~his~~ own client certificate. Log in as the new user. Create a certificate request for a certificate of type 'ssl_client_cert' with appropriate settings.		Each user can request their own client certificate. Log in as the new user. Create a certificate request for a certificate of type 'ssl_client_cert' with appropriate settings.

	You can view and approve the requested certificates as described above.		You can view and approve the requested certificates as described above.

	The user can ~~then~~ download and install the client certificate pfx on ~~his~~ OpenVPN client. Once again, ~~this~~ is beyond the scope of this document.		The user can download and install the client certificate pfx file on their OpenVPN client. Once again, that is beyond the scope of this document.

	==Extras==		==Extras==

Bt129: /* Replacing the ACF SSL cert */

2021-07-26T09:27:10Z

Replacing the ACF SSL cert

← Older revision		Revision as of 09:27, 26 July 2021
Line 101:		Line 101:
	Create a certificate of type 'ssl_server_cert' with appropriate settings (i.e. Common Name = server name)		Create a certificate of type 'ssl_server_cert' with appropriate settings (i.e. Common Name = server name)

	Download the certificate pfx and upload it to the ACF server (remember, this is generally separate from the standalone Certificate Authority server)		Download the certificate pfx file and upload it to the ACF server (remember, this is generally separate from the standalone Certificate Authority server)

	Replace the mini_httpd server certificate		Replace the mini_httpd server certificate

Bt129: /* View */

2021-07-25T17:53:07Z

View

← Older revision		Revision as of 17:53, 25 July 2021
Line 62:		Line 62:

	=== View ===		=== View ===
	Go to the View tab after you have the request form submitted. The view tab will show you pending requests ~~for certificates~~. Also available from this tab are ~~already~~ approved requests (generated certs), revoked certs, and the CRL.		Go to the View tab after you have the request form submitted. The view tab will show you pending certificate requests. Also available from this tab are approved requests (generated certs), revoked certs, and the CRL.

	For a Pending request, make sure to review the cert before approving it. Once you have verified ~~that all the information is correct, with~~ no ~~mis-types or spelling mistakes~~, ~~Approve~~ the request.		For a Pending request, make sure to review the cert before approving it. Once you have verified there are no errors, approve the request.

	The file ~~that will be~~ generated can be downloaded from the ACF. Use the command lines below to extract the pkcs12 file into its part to begin using it.		The file generated can be downloaded from the ACF. Use the command lines below to extract the pkcs12 file into its part to begin using it.

	=== Extract PFX certificate ===		=== Extract PFX certificate ===

Bt129: /* Request Form */

2021-07-25T17:49:42Z

Request Form

← Older revision		Revision as of 17:49, 25 July 2021
Line 52:		Line 52:
	<tt>[v3_req]</tt>		<tt>[v3_req]</tt>

	You ~~could put in here~~:		You can insert:
	* subjectAltName ="IP:192.168.1.1"		* subjectAltName ="IP:192.168.1.1"
	* subjectAltName ="DNS:192.168.1.10"		* subjectAltName ="DNS:192.168.1.10"
Line 59:		Line 59:
	* crlDistributionPoints=URI:http://whatever.com/whatever.crl		* crlDistributionPoints=URI:http://whatever.com/whatever.crl

	Once ~~this~~ form ~~has been~~ filled out and the password entered click submit.		Once the form is filled out and the password entered, click submit.

	=== View ===		=== View ===

Bt129: /* Acf-openssl */

2021-07-25T17:48:14Z

Acf-openssl

← Older revision		Revision as of 17:48, 25 July 2021
Line 32:		Line 32:
	If you already have a CA that you would like to have the web interface manage you can upload it from the Status page (as a pfx file).		If you already have a CA that you would like to have the web interface manage you can upload it from the Status page (as a pfx file).

	From the Status tab, Click Configure(to remove most of the error messages).		From the Status tab, Click Configure (to remove most of the error messages).

	If you do not have a CA, To generate a new CA certificate:		If you do not have a CA, To generate a new certificate:
	Click the Edit Defaults tab. Input the Items that will be needed for the CA and any other certs generated from it then Click Save.		Click the Edit Defaults tab. Input the Items that will be needed for the CA and any other certs generated from it then Click Save.
	Click the Status tab. Input values for the input boxes to generate a CA and click Generate.		Click the Status tab. Input values for the input boxes to generate a CA and click Generate.