Page History

Note:  RadminD should create the SSL directories and install the CA on the host to be configured

.

# There are now 2 ways of doing this.  The old, by hand method, and the new pexpect script.
##  To use the pexpect script to setup certs, first check that openssl, python, and pexpect are installed.
{code}
openssl version
python
import pexcept
[ctrl-D]
{code}
##  If those works, and the reported versions of OpenSSL is above 0.9.8, and Python is above 2.2, you can continue with this method.
##*  If pexpect is not installed, it is available in the AMIT DSL, or from {the authors website:http://www.noah.org/wiki/Pexpect}.
##*  Generally, it is better to run this script from a local system, and use scp to put the certs into place.
## Install the ssl-certgen.py script, if not done already.
{code}
scp dracus@athena.dialup.mit.edu:/afs/athena.mit.edu/project/amit-dsl/Public/common-init/ssl-certgen.py /usr/local/bin
{code}
## Running it as is will create cert requests for the local hostname, and store everything in '/var/lib/ssl'.  Use '--cname' to set the hostname in the cert, '--certdir' to set the directory that cert requests are stored into, and '--privdir' to set the directory that private keys go into.  For help, use '--help'.
{code}
/usr/local/bin/ssl-certgen.py --help
/usr/local/bin/ssl-certgen.py --cname [some hostname] --certdir /home/dracus/tmp/certs --privdir /home/dracus/tmp/private
{code}
##  This will generate a private key, a self-signed temporary cert, and a cert request, and email the cert requset to 'mitcert@mit.edu'.
##  Create symbolic links to the key and temporary cert to get Apache to work with the standard config.
{code}
ln -s /var/lib/ssl/certs/`hostname`-temp-cert.pem /var/lib/ssl/certs/host-cert.pem
ln -s /var/lib/ssl/private/`hostname`-key.pem /var/lib/ssl/private/host-key.pem
{code}
# The old, by hand method also works.
## Check that the SSL directories are there, and cd to them.
{code}
ls -l /var/lib/ssl
cd /var/lib/ssl

{code}
##* If there are not there, create them.
{code}
mkdir /var/lib/ssl
mkdir /var/lib/ssl/certs
mkdir /var/lib/ssl/private
cd /var/lib/ssl

{code}
## Generate rsa key
##* This simply generates some random stuff:
{code}
ps > /tmp/foo
ps -elf >> /tmp/foo
cd /var/lib/ssl
openssl genrsa -rand /tmp/foo 1024 > /var/lib/ssl/private/`hostname`-key.pem

{code}
## Generate request for a certificate
{code}
cd /var/lib/ssl/
openssl req -key /var/lib/ssl/private/`hostname`-key.pem -new \
   > /var/lib/ssl/certs/`hostname`-req.pem

{code}
##* Input the requested information.
{code}
Please be aware, the organization (O) is:
Massachusetts Institute of Technology
and the common name (CN) is the name of the server or
service, including the domain name (.mit.edu).  Also, some servers, such
as Thalia servers, can represent an entire subdomain.  These servers
will need certificates issued with a wildcard in the domain name, such
as *.isda-thalia-1.mit.edu.

Remember, if the server is a Thalia server, it will need a wildcard
certificate and DNS record for *.`hostname`, and if it is doing any type of
authentication, it will need a joint client/server certificate to be able
to connect to the Shibboleth server (and have end users connect to it as
well).

{code}
## Send the cert request file to mitcert@mit.edu

{code

}
cat `hostname`-req.pem | mail -s "Cert request for rolesapp-test.mit.edu" -c map-support@mit.edu mitcert@mit.edu

{code}
## To generate a self signed temporary certificate, add the x509 and nodes options to the openssl command line.
{code}
cd /var/lib/ssl
openssl req -key /var/lib/ssl/private/`hostname`-key.pem -new -x509 -nodes > /var/lib/ssl/certs/`hostname`-temp-cert.pem

{code}
## When you receive a certificate from MIT Certificates, save it as:
{code}
/var/lib/ssl/certs/`hostname`-cert.pem

{code}
## Create the symlinks that will allow Apache to function correctly.
{code}
ln -s /var/lib/ssl/certs/`hostname`-cert.pem /var/lib/ssl/certs/host-cert.pem
ln -s /var/lib/ssl/private/`hostname`-key.pem /var/lib/ssl/private/host-key.pem

{code}
##*  You can use the self signed cert while waiting for the official one by symlinking it.
{code}
ln -s /var/lib/ssl/certs/`hostname`-temp-cert.pem /var/lib/ssl/certs/host-cert.pem

{code}
# Commands to view cert information:
#* to look at a request:
{code}
openssl req -in /afs/athena.mit.edu/project/amit-dsl/Private/ssl-certs/${hostname}
/host-req.pem \-text

{code}
#* to look at the private key:
{code}
openssl rsa -in /afs/athena.mit.edu/project/amit-dsl/Private/ssl-certs/${hostname}/host-key.pem -text

{code}
#* to look at the server certificate:
{code}
openssl x509 -in /afs/athena.mit.edu/project/amit-dsl/Private/ssl-certs/${hostname}/host-cert.pem -text
{code}