ELTRONIKA sp. z.o.o.
Ul. Warszawska 41 lok.7
05-092 Łomianki
www.eltronika.com
- Polska: +48 22 751 97 44
- Česká republika: +420 228 880 487
- Slovensko: +421 904 540 707
35
7.2.14
Generating SSL certificates
In order to use SSL authentication creating few files and copying them into
adequate fields under OpenVPN or IPsec tabs of www configuration is needed. This can
be done using PC with Linux and openssl installed. There is also Windows version of
software available at
http://gnuwin32.sourceforge.net/packages/openssl.htm
.
At first we need to create folder, in which all our keys and certificates will be
stored. Let's say it will be ~/keys. We create two files in it: list of certificates and file
enumerating them:
touch index.txt
echo 00 > serial
and subdirectories, where the certificates and keys will be stored:
mkdir private certs newcerts crl
In order to create certificates, the certificate authority (CA) is needed . It is ,,main''
certificate used to create other certificates. After creating private CA key:
openssl genrsa -des3 -out private/cakey.pem 1024
Warning:
please remember the CA password!
The CA certificate is generated:
openssl req -new -x509 -days 365 -key private/cakey.pem -out cacert.pem
When creating a certificate user has to provide some information like country,
state/province, city, company name, e-mail address and common name. The last field is
most important, it has to be unique for every device.
After creating CA certificate generation of certificate for every device used is needed.
At first the private key is generated:
openssl genrsa -des3 -out private/device1key.pem
Then we generate certificate request:
openssl req -new -key private/device1key.pem -out device1req.pem
Here user has to enter country, state etc. again. They can be the same as before except the
common name.
Certificate authority signs the certificate:
openssl ca -notext -in device1req.pem -out device1cert.pem
If certificate will be used on ELT modem, password on private key has to be disabled:
openssl rsa -in private/device1key.pem -out private/device1key.pem_nopass
