test

[hcoop/zz_old/ikiwiki] / DomTool / SslProcedures.mdwn

diff --git a/DomTool/SslProcedures.mdwn b/DomTool/SslProcedures.mdwn
new file mode 100755 (executable)
index 0000000..9f432ba
--- /dev/null
+++ b/DomTool/SslProcedures.mdwn
@@ -0,0 +1,50 @@
+'''Note''': You can generally avoid worrying about these details by using the scripts described in DomTool/AdminProcedures. The instructions here are mostly of interest to people implementing those scripts.\r
+\r
+These instructions assume you are running as a user in group `wheel` on `deleuze.hcoop.net`.\r
+\r
+= Creating a certificate authority =\r
+\r
+I followed the instructions on this page:\r
+  http://sial.org/howto/openssl/ca/\r
+\r
+This blog post revealed the source of a puzzling error:\r
+  http://ilovett.com/blog/projects/debian-apache-ssl\r
+It turns out leaving some fields (like the city name for your new certificate) blank leads to baffling messages!\r
+\r
+Extracting the relevant commands from the Makefile available at the former page, we run these commands to create our CA:\r
+{{{mkdir crl newcerts private\r
+chmod go-rwx private\r
+echo '01' > serial\r
+touch index\r
+# NOTE use "-newkey rsa:2048" if running OpenSSL 0.9.8a or higher\r
+openssl req -nodes -config openssl.cnf -days 1825 -x509 -newkey rsa -out ca-cert.pem -outform PEM}}}\r
+\r
+Now the directory structure of our CA exists, and we have the certificate we will use to sign certificates.\r
+\r
+= Creating a certificate for a node or user =\r
+\r
+I followed the instructions on these pages:\r
+  http://marc.theaimsgroup.com/?l=openssl-users&m=97049654211960&w=2\r
+\r
+  http://www.postgresql.org/docs/8.1/interactive/ssl-tcp.html\r
+\r
+The commands to run are:\r
+{{{openssl genrsa -out serverkey.pem\r
+openssl req -new -key serverkey.pem -out newreq.pem -days 365\r
+cat newreq.pem serverkey.pem > new.pem\r
+openssl ca -config /etc/domtool/openssl.cnf -policy policy_anything -out servercert.pem -infiles new.pem}}}\r
+replacing `serverkey.pem` and `servercert.pem` with appropriate names for your new key and certificate, respectively.  The change I made from [http://marc.theaimsgroup.com/?l=openssl-users&m=97049654211960&w=2 the cited source] is to include the `-config` flag to reference the modified config file obtained from [http://sial.org/howto/openssl/ca/ the page about creating a CA].\r
+\r
+Once I figure out the final directory layout, there will be instructions here on where to put these files once they're created.\r
+\r
+= Baffling things that can happen =\r
+\r
+If `openssl ca` tells you this:\r
+{{{failed to update database\r
+TXT_DB error number 2}}}\r
+\r
+it means that you have it configured not to sign a certificate for the same user multiple times, but you've gone ahead and asked it to do so anyway.  Add this line to the section for your default CA in `openssl.cnf`:\r
+{{{\r
+unique_subject = no}}}\r
+\r
+If you've already been signing some keys and you want to keep what you've done so far, you may also need to make similar changes in `index.attr` and possibly `index.attr.old`.\r