6–18
MULTINET4 MULTI-PORT SERIAL SERVER & MANAGED SWITCH – INSTRUCTION MANUAL
OPERATIONAL GUIDE
CHAPTER 6: OPERATIONAL GUIDE
H7tPOFStc9IygR36FOPasCoNxze9DofIfC8IypSf28LXAgMBAAEwDQYJ
KoZIhvcNAQEFBQADgYEAEq3kTPfT5i1Z5XtXtOatCw/wDhC6DME2XY5E
OnuJchpFGgTPmA1z5neUTYT9pHX50rutrk28vvj6ELn1XLD5sp6Hqxj5Wslo4jDb
LFxgft46TUgISqRHiSbixWfsLSNqf3cpGjMQjWO8xtEExNDuk7NUVbM=
-----END CERTIFICATE-----
6.5.3.7 Key Exchange
SSL does not use RSA keys to actually encrypt data sent over the secure connection. Before
data transmission can begin, the peer entities must agree on a shared secret key that will
be used by a symmetric encryption algorithm such as 3DES or AES. This process is called
key exchange. The SSL client encrypts a random secret using the server’s public RSA key
and passes the result to the server. Since only the server knows the matching private key, it
is the only entity that can decrypt the message and discover the shared secret.
Multinet4 does not currently support alternative key exchange algorithms such as Diffie-
Hellman.
6.5.3.8 Peer Authentication
Multinet4 supports peer authentication for both clients and servers but it is always
optional and configurable by the user. By default, peer authentication is not performed.
When peer authentication is required, the SSL handshake fails and the connection is closed
unless the following conditions are met:
1.
The entity being authenticated must prove that it owns the public key in the
certificate that it presented. This is accomplished by using its private key to
encrypt some data that the authenticator decrypts and verifies.
2.
The signature on the supplied certificate must be valid and verifiable (that is,
the signing entity’s certificate must be signed by another verifiable entity or
by a trusted entity such as a CA).
3.
The current system date and time must be within the supplied certificate’s
valid time range.
6.5.3.9 Certificate and Key File Generation
This section gives an example of how to create a root CA Certificate and System Key File
that can be used in conjunction with Multinet4. The example uses the OpenSSL command
line tool, which is freely available software that runs under Linux, MAC OS-X, and Cygwin
for Microsoft Windows. For more information on OpenSSL, see the following text:
Viega, John. Messier, Matt. Pravir, Chandra.
Network Security with OpenSSL
, O’Reilly Media
Inc., ISBN 0-596-00270-X.
Note
In the following example files text in italic font is user-supplied input.
Step 1: Generate an RSA key and a certificate request for your CA
$ openssl req -newkey rsa:1024 -nodes -sha1 -keyout cakey.pem -out
careq.pem