313
1.877.877.2269
BLACKBOX.COM
NEED HELP?
LEAVE THE TECH TO US
LIVE 24/7
TECHNICAL
SUPPORT
1.877.877.2269
CHAPTER 16: ADVANCED CONFIGURATION
The OpenSSL project itself ‘highly recommends’ Ivan Ristić’s OpenSSL Cookbook, available as a free download from https://
feistyduck.com/books/openssl-cookbook/.
16.8 HTTPS
The Management Console UI is served using HTTPS by the built in cherokee webserver.
If your default network address is changed or the unit is to be accessed via a known Domain Name you can use the following steps
to replace the default SSL Certificate and Private Key with ones tailored for your new address.
16.8.1 GENERATING AN ENCRYPTION KEY
To create a 1024 bit RSA key with a password issue the following command on the command line of a linux host with the openssl
utility installed:
# openssl genrsa -des3 -out ssl_key.pem 1024
16.8.2 GENERATING A SELF-SIGNED CERTIFICATE WITH OPENSSL
This example shows how to use OpenSSL to create a self-signed certificate on a Linux- or Unix-based system. OpenSSL ships as
part of macOS and is available for most Linux distributions via the default package management mechanism.
The OpenSSL project ‘does not distribute any code in binary form, and does not officially recommend any specific binary
distributions.’ The project does, however, maintain a page on its community wiki: https://wiki.openssl.org/index.php/Binaries.
This page lists 3rd-party binaries that are ‘stable and can provide continued support for OpenSSL’. Windows users should check
here for a suitable binary.
To create a 1024-bit RSA key and a self-signed certificate, issue the following command from the host you have openssl installed
on:
# openssl req -x509 -nodes -days 1000 -newkey rsa:1024 -keyout \
ssl_key.pem -out ssl_cert.pem
You will be prompted to enter a lot of information. Most of it doesn't matter, but the Common Name should be the domain name of
your computer (for example, test.Black Box.com).
When you have entered everything, the certificate will be created in a file called ssl_cert.pem.
16.8.3 INSTALLING THE KEY AND CERTIFICATE
The recommended method for copying files securely to the console server unit is with a Secure Copying Protocol client (for
example, the shell-based tool: scp).
The scp utility ships with macOS and ships with OpenSSH for most Linux distributions. Windows users can use something like the
PSCP command line utility available with PuTTY.
The files created in the steps above can be installed remotely with the scp utility as follows:
# scp ssl_key.pem root@<address of unit>:/etc/config/
# scp ssl_cert.pem root@<address of unit>:/etc/config/
