3
rd
Generation Rack-
Mount RDMS™
104
Quasonix, Inc.
[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier=keyid:always
[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning
[ alternate_names ]
# Provide all IP and DNS names used by this server
# IP.1 = x.x.x.x
# DNS.1 = rdms1.xxx
IP.1
= 10.1.1.18
DNS.1
= mytestrdms.q
Change the following entries to match your setup:
•
‘dir’ –
should indicate the path to your main directory
•
‘default_days’ –
change to the number of days you want the certificate to be valid
•
‘IP.1’ –
set to the IP address of the RDMS
•
‘DNS.1’ (.2, .3,
etc.)
–
set to the DNS name(S)
you’ve given this RDMS in your DNS server
4.4.2.27.3.1.1.2 Create a Certificate Authority (CA) and Key (Optional)
If you do not already have a Certificate Authority that will sign your server certificate, you must create one. This
only needs to be done once if you are signing multiple server certificates. Change directory to the directory you
created above and perform these steps:
1.
Generate CA Key
a.
openssl genrsa -aes256 -out private/ca.key.pem 4096
b.
When prompted, provide a passphrase that you will use when signing server certificates
2.
Generate CA Certificate
a.
openssl req -config openssl.cnf -key private/ca.key.pem -new -x509 -days 7300 -sha256 -extensions
v3_ca -out certs/ca.cert.pem
b.
When prompted, provide the passphrase created in the previous step.
c.
Provide Country Name, State or Province Name, Locality, Org Name, Org Unit Name, Common
Name, and Email Address for the Certificate Authority. Common Name is required.
4.4.2.27.3.1.1.3 Create Server Certificate and Private Key
Next, generate the server certificate and key that will be uploaded to the RDMS and used by it when connections are
made to the browser interface over HTTPS.
1.
Generate RDMS Server Key
a.
openssl genrsa -out private/rdms1.key.pem 2048
2.
Generate RDMS Server Certificate Signing Request (CSR)
a.
openssl req -config openssl.cnf -key private/rdms1.key.pem -new -sha256 -out csr/rdms1.csr.pem
