I had to deal with S/MIME-certificates a lot recently. Even though i conecptionally do know about public key cryptography and certificates I rarely had to deal with openssl. So i took some time and worked through this tutorial by jamielinux.com about creating a private public key infrastructure comprising of a root ca and a intermediary ca. I accompanied my reading with the writing of a shell script that basically is the extraction of the shell script included in the tutorial. To make it run you should also download this file. It consists of the two openssl configuration files mentioned in jamie linux‘ tutorial. Fire up the script and you get a root ca and three intermediary ca’s.
#!/bin/sh
#
# Author: Matthias
#
set -x
BASE=$(pwd)
ROOT_DIR=${BASE}/PKI_0/ROOT
ROOT_KEY=private/ca.key.pem
ROOT_CERT=certs/ca.cert.pem
KEYSIZE=2048
ENCRYPT=
#ENCRYPT=-aes256
mkdir -p ${ROOT_DIR}
cd ${ROOT_DIR}
mkdir certs crl newcerts private
chmod 700 private
touch index.txt
echo 1000 > serial
cp -v ${BASE}/resources/openssl-root.cnf openssl.cnf
sed -i -e "s#%ROOT_DIR%#${ROOT_DIR}#" openssl.cnf
# create the root key
echo "#"
echo "# Creating encrypted key-pair"
echo "#"
openssl genrsa ${ENCRYPT} -out ${ROOT_KEY} ${KEYSIZE}
chmod 400 ${ROOT_KEY}
# create certificate from root key and personal data
echo "#"
echo "# Creating certificate"
echo "#"
openssl req -config openssl.cnf \
-key ${ROOT_KEY} \
-new -x509 -days 7300 -sha256 -extensions v3_ca \
-out ${ROOT_CERT} \
-subj "/C=DE/ST=NRW/L=Aachen/O=Private/OU=NA/CN=Ernie/emailAddress=ernie@sesamstreet.com"
#
# Verify the root certificate
#
echo "Do you want to verify the certificate (y/n)?"
read -n 1
if [[ ${REPLY} == "y" ]] ; then
echo "#"
echo "# Verifying certificate"
echo "#"
openssl x509 -noout -text -in ${ROOT_CERT}
fi
for INDEX in 0 1 2 ; do
INTERMEDIATE_DIR=${BASE}/PKI_0/INTERMEDIARIES/${INDEX}
INTERMEDIATE_KEY=${INTERMEDIATE_DIR}/private/intermediate.key.pem
INTERMEDIATE_CSR=${INTERMEDIATE_DIR}/csr/intermediate.csr.pem
INTERMEDIATE_CERT=${INTERMEDIATE_DIR}/certs/intermediate.cert.pem
mkdir -p ${INTERMEDIATE_DIR}
cd ${INTERMEDIATE_DIR}
mkdir certs crl csr newcerts private
chmod 700 private
touch index.txt
echo 1000 > serial
cp -v ${BASE}/resources/openssl-intermediate.cnf openssl.cnf
sed -i -e "s#%ROOT_DIR%#${INTERMEDIATE_DIR}#" openssl.cnf
echo 1000 > ${INTERMEDIATE_DIR}/crlnumber
# create the intermediate key
echo "#"
echo "# Creating encrypted key-pair"
echo "#"
cd ${ROOT_DIR}
openssl genrsa ${ENCRYPT} -out ${INTERMEDIATE_KEY} ${KEYSIZE}
chmod 400 ${INTERMEDIATE_KEY}
# create certificate from root key and personal data
echo "#"
echo "# Creating intermediate certificate"
echo "#"
cd ${ROOT_DIR}
openssl req -config ${INTERMEDIATE_DIR}/openssl.cnf \
-new -sha256 \
-key ${INTERMEDIATE_KEY} \
-out ${INTERMEDIATE_CSR} \
-subj "/C=DE/ST=NRW/L=Aachen/O=Private/OU=NA/CN=Dummy Intermediate ${INDEX}/emailAddress=intermediate_${INDEX}@dummy.local"
cd ${ROOT_DIR}
openssl ca -config openssl.cnf -extensions v3_intermediate_ca \
-days 3650 -notext -md sha256 \
-in ${INTERMEDIATE_CSR} \
-out ${INTERMEDIATE_CERT}
chmod 444 ${INTERMEDIATE_CERT}
# Verify the interemediate certificate
#
echo "Do you want to verify the intermediate certificate (y/n)?"
read -n 1
if [[ ${REPLY} == "y" ]] ; then
echo "#"
echo "# Verifying certificate"
echo "#"
openssl x509 -noout -text -in ${INTERMEDIATE_CERT}
openssl verify -CAfile ${ROOT_CERT} ${INTERMEDIATE_CERT}
fi
done
################
# #
# End of file #
# #
################
If you are still reading your are propably very interested in certificates and s/mime. I have one more thing to share – I have collected a couple of information about related rfcs and some terminology. The information is partly copied from a stackoverflow answer. Basically a list of who is who in s/mime related rfc’s. Click here to go there.
Neueste Kommentare