cern:certificates
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| cern:certificates [2011/10/03 11:47] – tmp nchiap | cern:certificates [2014/07/22 21:10] (current) – [New Certificate Authority] nchiap | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Managing Certificates ====== | ====== Managing Certificates ====== | ||
| - | (still to be improved) | + | (not everything has been tested) |
| =====A Basic Introduction to Public-Key-Cryptography===== | =====A Basic Introduction to Public-Key-Cryptography===== | ||
| - | All this business with certificates uses public-key cryptography. The basic idea is, that everyone has a key-pair consisting of **a private and a public key**. As the name suggests the private key is kept private, the public one is made public. Messages encrypted with one of the keys can only be decrypted with the other. We will now look at the three most common ways to use this fact. | + | All this business with certificates uses public-key cryptography. The basic idea is, that everyone has a key-pair consisting of **a private and a public key**. As the name suggests the private key is kept private, the public one is made public. Messages encrypted with one of the keys can only be decrypted with the other. We will now look at the most common ways to use this fact. |
| ==== Private Messages ==== | ==== Private Messages ==== | ||
| Line 17: | Line 17: | ||
| ==== Certificates ==== | ==== Certificates ==== | ||
| - | A possible solution for this are certificates. A is a document that contains your public key and other information about you. It has to be signed by a Certificate Authority (CA). With it's signature the Certificate Authority confirms that they checked your identity and the information in the certificate is valid. | + | A possible solution for this are certificates. A certificate |
| - | Obviously the certificate is useless without the private key belonging to it or once the private key got compromised. So make sure to protect your private key properly, nobody else should be able to get the file with it. | + | Obviously the certificate is useless without the private key belonging to it or once the private key got compromised. So make sure to protect your private key properly, nobody else should be able to get the file with it and you should not loose it. |
| ===== | ===== | ||
| Line 26: | Line 26: | ||
| (Of course now the problem is how to distribute the public key of the Certificate Authority. Still this is a comparatively easy problem.) | (Of course now the problem is how to distribute the public key of the Certificate Authority. Still this is a comparatively easy problem.) | ||
| + | CERN has its own Certificate Authority. You find its website under [[https:// | ||
| - | =====Doing the work===== | + | ===== Obtaining a key-pair and certificate from CERN ===== |
| - | CERN has its own Certificate Authority. You find its website under [[https:// | + | |
| - | ==== getting started ==== | ||
| - | First you will need to generate a key pair and prepare a certificate request. | ||
| - | For this you log into lxplus and change to the private directory. There you run | ||
| - | openssl req -new -out myrequest.csr -sha1 # ceate a new key-pair and prepare a certificate request | ||
| - | The command above generates two files. **privkey.pem** will contain your private key, | ||
| - | **myreqeust.csr** contains the certificate request. | ||
| - | The next step is to | + | ==== New Certificate Authority ==== |
| + | - Request a [[https:// | ||
| + | - Follow [[https:// | ||
| + | =====other useful things ===== | ||
| - | from your private key you can generate the corresponding public key: | + | ====print public key==== |
| - | openssl rsa -in privatkey.pem -pubout | + | from your private key you can generate the corresponding public key |
| - | (you use the RSA backend with your privat-key as input and output the public key) | + | openssl rsa -in privkey.pem -pubout |
| - | The public key is what other people can use to send you encrypted messages - | + | |
| - | or decrypt things you encrypted with your private key. | + | |
| - | ====obtaining a new certificate | + | ====print certificate |
| - | you can as well prepare a certificate | + | you can print all the information stored in your certificate |
| - | openssl | + | openssl |
| - | A certificate | + | ==== create a pkcs12 file (used by web-browsers) ==== |
| - | private key of you and the Certificat Authority. | + | (tested with Firefox and Opera) |
| + | To use the certificate | ||
| + | openssl pkcs12 -export -inkey privkey.pem -in certificate.cer -out combined.p12 | ||
| + | You can then import this file into the certificate configuration of your browser | ||
| + | (Firefox: edit > preferences > advanced > view certificates) | ||
| - | So the next step is to upload | + | ==== export from a pkcs12 file==== |
| - | from where you get a signed certificat. | + | export |
| + | openssl pkcs12 -clcerts -nokeys -in combined.p12 -out certificat.pem | ||
| + | export | ||
| + | | ||
| + | |||
| + | if you work on a SLC machine, you can also use a special script for this: | ||
| + | cert-convert.sh combined.p12 | ||
| + | ===== Useful Links===== | ||
| + | * [[http:// | ||
| + | * [[http:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | ====== Outdated ====== | ||
| + | The explanation below is outdated. | ||
| + | CERN does not sign certificate requests for existing keys any longer. | ||
| + | You will have to generate a new pair with a private-key and certificate every year. | ||
| - | ====using the certificate==== | + | =====Getting Started (generate a first key pair and certificate) ===== |
| - | ===for web-browsing=== | + | First you will need to generate |
| - | to use the certificate in a browser (firefox or opera) | + | For this you log into lxplus and change |
| - | certificate and the private-key into a pkcs12 file: | + | |
| - | | + | Since you specified no private key the command above generates a private key first. |
| + | You get asked for a password to secure your private key with. | ||
| + | Choose a good one and do not forget it. | ||
| + | After that you can provide additional information about yourself if you want. | ||
| + | You can just press enter if you want. | ||
| + | When done you have two files in your current directory. **privkey.pem** will contain your private key, | ||
| + | **myreqeust.csr** contains the certificate request. | ||
| - | from the pkcs12 file you get can export your keys: | + | The next step is to get the certificate request signed by the Certificate Authority. |
| - | | + | Select [[https:// |
| - | | + | After you passed the identity check a from with one large text box will be shown to you. |
| + | Copy and paste the content of myrequest.csr into the form. | ||
| - | ===for | + | After submitting |
| - | for gird-usage put files in ~/.globus: | + | I recommend you safe this under something like '' |
| - | usercert.pem (certificat) | + | |
| - | | + | |
| + | =====Preparing for Grid Usage (on lxplus)===== | ||
| + | To use your certificate for the grid you need to copy the two files in ~/.globus with the following names: | ||
| + | certificat: usercert.pem | ||
| + | privat key: userkey.pem | ||
| + | It is a good idea to create a symbolic link instead of a copy. | ||
| + | This helps you to know which certificate you actually use. | ||
| + | |||
| + | You can then test your setup by calling | ||
| + | lhcb-proxy-init | ||
| + | |||
| + | =====Obtaining | ||
| + | You can not really renew an old certificate. | ||
| + | Instead you need to acquire a new certificate for your existing key-pair. | ||
| + | openssl req -new -key privkey.pem # request a new certificate using your private key | ||
| + | |||
| + | The next step is now again to [[https:// | ||
| + | Again you get a signed certificate back and store it with a helpful name. | ||
| + | Probably you will then want to update your files in ~/.globus, so copy the **.cer** into that directory and replace the symlink for '' | ||
| - | ===== Useful Links===== | ||
| - | [[http:// | ||
cern/certificates.1317635270.txt.gz · Last modified: 2011/10/03 11:47 by nchiap
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial-Share Alike 4.0 International
