Creating SSL certs using ACF

You are in need of creating certificate for remote persons. You might use something like openvpn or racoon for your vpn services.
But wouldn't it be nice to have some sort of way to...

create and manage certs
view all the certs you have given to everyone
revoke certs
review the certificate before you issue it
etc.

Alpine, via the ACF, has a nice web interface to use for this sort of job...

Installation Process

This will somewhat guide you through the process of creating this type of server.
It is suggested to not host this on you VPN gateway but use another machine to generate your certificates.

Prepare hardware and install Alpine

Start by setting up a box that will serve as your openvpn-server.
Please read 'Installing_Alpine' for instructions on how to do this.

Install and configure ACF

Install the web front end to Alpine Linux, called ACF.

/sbin/setup-webconf

Install acf-openssl (ACF for openssl)

apk add acf-openssl

Now you should be ready to start browsing to your OpenVPN-server by using a web-browser at another computer.
Note: Assuming you have configured and attached this openvpn-server to a network.

Configure

Start by browsing to your openvpn-server by entering https://{ipaddr}/ in your browser
Click 'login' at the top of the page.
Note: Most older Alpine versions has a default account (user=alpine / password=test123)

Change default username/password

Start by changing the default username/password.

Click on the User Management tab and change the password.
Also make sure to create yourself an account.

Certificate Authority

Click on 'Certificate Authority' on the menu.
It should give you a page with 'System info' and a lot of red error messages.

Initial configuration

Because this is the first time you use this ACF you will need to do some initial configuration.
Click on the [Configure] button at the page.

Edit defaults

Go to the {Edit Defaults} tab.
Input the items that will be needed for the CA and any other certs generated from it.

Save your settings by clicking [Save].

Generate a certificate with ACF

Create the ca.crt

First we need to create the CA-certificate (this is the cert used when creating other certificates).

Now go to the {Status} tab.
Click [Generate] button to generate your CA-certificate.
The ca-certificate information will be displayed.

Note: This action can only be done once. In the future, the {Status} page will show the CA-information.
The [Generate] button doesn't exist no more.

Request Form

Provided Fields:

Country Name (2 letter abreviation)
Locality Name (e.g. city)
Organization Name
Common Name (eg, the certificate CN)
Email Address
Multiple Organizational Unit Name (eg, division)
Certificate Type

A box has been set aside for adding Additional x509 Extensions formatted the same as if you were to fill out a section directly in openssl.cnf. Section would be [v3_req]

You could put in here:

subjectAltName ="IP:192.168.1.1"
subjectAltName ="DNS:192.168.1.10"

Once this form has been filled out and the password entered click submit.

View

Once the request form has been filled out go to the View tab. This will show you pending requests for certificates. Also available from this tab is CRL, already approved requests and the cert generated, along with revoked certs.

For a Pending request make sure to review the cert before approving it. Once you have verified that all the information is correct, no mis-types or spelling mistakes Approve the request.

The file that will be generated can be downloaded from the ACF. Use the command lines below to extract the pkcs12 file into its part to begin using it.

Extract PFX certificate

To get the CA CERT

openssl pkcs12 -in PFXFILE -cacerts -nokeys -out cacert.pem

To get the Private Key

openssl pkcs12 -in PFXFILE -nocerts -nodes -out mykey.pem

To get the Certificate

openssl pkcs12 -in PFXFILE -nokeys -clcerts -out mycert.pem

Display the cert or key readable/text format

openssl x509 -in mycert.pem -noout -text

OpenSSL command line to create your CA

The following command will need a password. Make sure to remember this.

openssl genrsa -des3 -out server.key 2048

openssl req -new -key server.key -out server.csr

openssl rsa -in server.key. -out server.pem

openssl x509 -req -days 365 -in server.csr -signkey server.pem -out cacert.pem

mv server.pem /etc/ssl/private; mv cacert.pem /etc/ssl/

Edits to /etc/ssl/openssl-ca-acf.cnf

Via the expert tab on ACF edit the openssl-ca-acf.cnf file. Something like subjectAltName can be added to be used by the certificates that you generate.

3.subjectAltName = Assigned IP Address

3.subjectAltName_default = 192.168.1.1/32