Warning: Declaration of P_Photocrati_NextGen::define() should be compatible with C_Base_Product::define($id = 'pope-produ...', $name = 'Pope Produ...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/product.photocrati_nextgen.php on line 72

Warning: Declaration of M_Fs::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/fs/module.fs.php on line 34

Warning: Declaration of M_Router::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/router/module.router.php on line 50

Warning: Declaration of M_I18N::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/i18n/module.i18n.php on line 202

Warning: Declaration of M_Validation::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/validation/module.validation.php on line 30

Warning: Declaration of M_WordPress_Routing::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/wordpress_routing/module.wordpress_routing.php on line 74

Warning: Declaration of M_Security::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/security/module.security.php on line 54

Warning: Declaration of M_Lzw::define($context = false) should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/lzw/module.lzw.php on line 36

Warning: Declaration of M_NextGen_Settings::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_settings/module.nextgen_settings.php on line 36

Warning: Declaration of M_MVC::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/mvc/module.mvc.php on line 73

Warning: Declaration of M_Ajax::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/ajax/module.ajax.php on line 101

Warning: Declaration of M_Dynamic_Stylesheet::define($context = false) should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/dynamic_stylesheet/module.dynamic_stylesheet.php on line 51

Warning: Declaration of M_Frame_Communication::define($context = false) should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/frame_communication/module.frame_communication.php on line 69

Warning: Declaration of M_DataMapper::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/datamapper/module.datamapper.php on line 212

Warning: Declaration of M_NggLegacy::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/ngglegacy/module.ngglegacy.php on line 50

Warning: Declaration of M_NextGen_Data::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_data/module.nextgen_data.php on line 117

Warning: Declaration of M_Dynamic_Thumbnails::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/dynamic_thumbnails/module.dynamic_thumbnails.php on line 51

Warning: Declaration of M_NextGen_Admin::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_admin/module.nextgen_admin.php on line 156

Warning: Declaration of M_NextGen_AddGallery_Page::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_addgallery_page/module.nextgen_addgallery_page.php on line 63

Warning: Declaration of M_NextGen_Pagination::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_pagination/module.nextgen_pagination.php on line 28

Warning: Declaration of M_Gallery_Display::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_gallery_display/module.nextgen_gallery_display.php on line 368

Warning: Declaration of M_Attach_To_Post::define($context = false) should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/attach_to_post/module.attach_to_post.php on line 399

Warning: Declaration of M_NextGen_Other_Options::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_other_options/module.nextgen_other_options.php on line 87

Warning: Declaration of M_NextGen_Pro_Upgrade::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_pro_upgrade/module.nextgen_pro_upgrade.php on line 36

Warning: Declaration of M_MediaRss::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/mediarss/module.mediarss.php on line 44

Warning: Declaration of M_Cache::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/cache/module.cache.php on line 40

Warning: Declaration of M_Lightbox::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/lightbox/module.lightbox.php on line 321

Warning: Declaration of M_NextGen_Basic_Album::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_album/module.nextgen_basic_album.php on line 148

Warning: Declaration of C_NextGen_Basic_Album_Installer::install() should be compatible with C_Gallery_Display_Installer::install($reset = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_album/class.nextgen_basic_album_installer.php on line 25

Warning: Declaration of M_NextGen_Basic_Templates::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_templates/module.nextgen_basic_templates.php on line 50

Warning: Declaration of M_NextGen_Basic_Gallery::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_gallery/module.nextgen_basic_gallery.php on line 244

Warning: Declaration of C_NextGen_Basic_Gallery_Installer::install() should be compatible with C_Gallery_Display_Installer::install($reset = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_gallery/class.nextgen_basic_gallery_installer.php on line 27

Warning: Declaration of M_NextGen_Basic_ImageBrowser::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_imagebrowser/module.nextgen_basic_imagebrowser.php on line 126

Warning: Declaration of C_NextGen_Basic_ImageBrowser_Installer::install() should be compatible with C_Gallery_Display_Installer::install($reset = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_imagebrowser/class.nextgen_basic_imagebrowser_installer.php on line 17

Warning: Declaration of M_NextGen_Basic_Singlepic::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_singlepic/module.nextgen_basic_singlepic.php on line 127

Warning: Declaration of C_NextGen_Basic_SinglePic_Installer::install() should be compatible with C_Gallery_Display_Installer::install($reset = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_singlepic/class.nextgen_basic_singlepic_installer.php on line 16

Warning: Declaration of M_NextGen_Basic_Tagcloud::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_tagcloud/module.nextgen_basic_tagcloud.php on line 146

Warning: Declaration of C_NextGen_Basic_Tagcloud_Installer::install() should be compatible with C_Gallery_Display_Installer::install($reset = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_basic_tagcloud/class.nextgen_basic_tagcloud_installer.php on line 21

Warning: Declaration of M_Widget::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/widget/module.widget.php on line 54

Warning: Declaration of M_Third_Party_Compat::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/third_party_compat/module.third_party_compat.php on line 374

Warning: Declaration of M_NextGen_XmlRpc::define() should be compatible with C_Base_Module::define($id = 'pope-modul...', $name = 'Pope Modul...', $description = '', $version = '', $uri = '', $author = '', $author_uri = '', $context = false) in /data/web/virtuals/50643/virtual/www/subdom/wp/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_xmlrpc/module.nextgen_xmlrpc.php on line 633
How to become a Certification Authority | Dejvino's notebook

How to become a Certification Authority

This short How-To has been compiled based on the work I’ve done so far while building my personal home server. To achieve reasonable level of privacy without spending a fortune on it, I’ve become my own Certification Authority (CA).

Overview

These are the basic steps covered later in detail:

  1. Create a CA key and certificate.
  2. Create a server key and a Certificate signing request (CSR).
  3. Sign the CSR using the CA key.
  4. Use the new server certificate in Apache.
  5. Import the CA certificate into your browsers.
  6. … Profit!

What this results in is a single certificate file for your CA that you distribute and import into your browsers (PC, phone, …). Every individual signed server / service certificate you create and use is then automatically recognized as valid and trusted. If you are using a personal set of services (various web applications, XMPP server, etc.), this saves you a lot of “exception adding”, just import one (your) CA certificate and everything is working, no need for the browser to nag about self-signed certificates.

Detailed how-to

Creating a CA key pair

First, prepare your “playground”, a data storage somewhere on your (preferably Linux) computer. It should look like this:

root-ca
 |-- conf     ... for configuration files.
 |-- private  ... for private CA key (protect this directory!)
 |-- public   ... for public CA key
 |-- requests ... for incoming CSR
 +-- certs    ... for resulting certificates

Now cd to the root-ca directory. Create a configuration file conf/openssl.conf with the following content:

[ req ]
default_bits            = 2048
default_keyfile         = ./private/root.pem
default_md              = sha1
prompt                  = no
distinguished_name      = root_ca_distinguished_name
x509_extensions = v3_ca

[ root_ca_distinguished_name ]
countryName             = UK
stateOrProvinceName     = Sussex
localityName            = Brighton
0.organizationName      = Example Inc
commonName              = Example Inc Root CA
emailAddress            = david@example.com

[ v3_ca ]
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer:always
basicConstraints        = CA:true

[ ca ]
default_ca              = CA_default

[ CA_default ]
dir                     = .
new_certs_dir           = ./certs/
database                = ./conf/index
certificate             = ./public/root.pem
serial                  = ./conf/serial
private_key             = ./private/root.pem
x509_extensions         = usr_cert
name_opt                = ca_default
cert_opt                = ca_default
default_crl_days        = 30
default_days            = 365
default_md              = sha1
preserve                = no
policy                  = policy_match

[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ usr_cert ]
basicConstraints        = CA:FALSE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer:always
nsCaRevocationUrl       = https://www.example.com/example-ca-crl.pem

It might look long and complicated, but most of it is pretty self explanatory. What you should edit is the root_ca_distinguished_name section and the nsCaRevocationUrl.

Then initialize the “certificate counters”, like so:

echo "01" > conf/serial
touch conf/index

Finally, generate a CA key pair (public and private root.pem files):

openssl req -nodes -config conf/openssl.conf -days 1825 -x509 -newkey rsa:2048 -out public/root.pem -outform PEM

Creating a server key pair

On the server for which you want to obtain a signed certificate, do this:

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

Then you can transfer the server.csr file to the CA’s requests directory.

Signing the CSR

Simply call this command and you get a signed certificate server.cert from a request server.csr:

openssl ca -batch -config conf/openssl.conf -in requests/server.csr -out certs/server.cert

Setting up SSL in Apache

Somewhere in the httpd.conf or inside a virtual host configuration add these lines:

 Listen 443
 SSLEngine on
 SSLCertificateFile /path/to/keys/server.cert
 SSLCertificateKeyFile /path/to/keys/server.key
 SSLCertificateChainFile /path/to/keys/root.pem

These lines activate SSL and the port for SSL, specify server certificate, private certificate key and (optionally) root CA certificate. After restarting the server, HTTPS should be ready to use.

Importing and using

Different applications have different ways of importing trusted CA certificates.

On Windows, you just “execute” the certificate and install it into the appropriate category. This should take care of most of your applications. Web browser (e.g. Firefox) might need to have this certificate installed explicitly, ignoring certificates in the OS.

On Linux, look for /etc/ca-certificates.conf, add the certificate filename there and copy the file to /usr/share/ca-certificates/. Then run update-ca-certificates –fresh to recreate the list of known certificates.

 

Based on these articles:

(2805)
Posted in Linux, Open source, Privacy, Projects, Technology, Web development

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Unable to load the Are You a Human PlayThru™. Please contact the site owner to report the problem.