Novell OPEN ENTERPRISE SERVER 2 SP2 - ADMINISTRATION, Implementation Manual, Page: 225 / 288

Certificate Management
22
225
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
22
Certificate Management
By default, all SUSE
®
Linux Enterprise Server (SLES) 10 servers include self-generated server
certificates to secure data communications with the servers. These certificates are self-signed and do
not comply with the X.509 RFCs. They are provided only as a stop-gap and should be replaced as
soon as possible by a certificate from a trusted Certificate Authority.
Unfortunately, many organizations ignore the vulnerabilities to mischievous or even malicious
attacks that are created by not replacing these temporary certificates. Some of the reasons for this are
Š
Many administrators lack the knowledge required.
Š
Certificate maintenance can require a significant investment of time and effort.
Š
Obtaining third-party certificates for each server is expensive.
The problems are compounded by the fact that X.509 certificates are designed to expire regularly
and should be replaced shortly before they do.
Open Enterprise Server 2 includes solutions that address each of these issues at no additional
expense.
This section discusses the certificate management enhancements available in OES 2 and how simple
and straightforward it is to take advantage of these.
Š
Section 22.1, “Overview,” on page 225
Š Section 22.2, “Setting Up Certificate Management,” on page 228
Š
Section 22.3, “If You Don’t Want to Use eDirectory Certificates,” on page 230
22.1 Overview
The following sections outline how OES 2 lets you automate certificate management for OES 2 and
all HTTPS services:
Š
Section 22.1.1, “SLES Default Certificates,” on page 225
Š
Section 22.1.2, “OES 2 Certificate Management,” on page 226
Š
Section 22.1.3, “Multiple Trees Sharing a Common Root,” on page 228
22.1.1 SLES Default Certificates
By default, HTTPS services on SLES 10 SP1 are configured to use two files that are located in
/
etc/ssl/servercerts
and are protected so that only
root
and some specific groups can read
them:
Š
serverkey.pem: This contains the server’s raw private key.
Š
servercert.pem: This contains the server’s certificates.
OES 2 services, such as Apache, OpenWBEM, and Novell Remote Manager, are also configured to
use these certificates.