cern:certificates
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| cern:certificates [2011/10/03 14:01] – improved explanation on CA nchiap | cern:certificates [2014/07/22 21:10] (current) – [New Certificate Authority] nchiap | ||
|---|---|---|---|
| Line 2: | Line 2: | ||
| (not everything has been tested) | (not everything has been tested) | ||
| =====A Basic Introduction to Public-Key-Cryptography===== | =====A Basic Introduction to Public-Key-Cryptography===== | ||
| - | All this business with certificates uses public-key cryptography. The basic idea is, that everyone has a key-pair consisting of **a private and a public key**. As the name suggests the private key is kept private, the public one is made public. Messages encrypted with one of the keys can only be decrypted with the other. We will now look at the three most common ways to use this fact. | + | All this business with certificates uses public-key cryptography. The basic idea is, that everyone has a key-pair consisting of **a private and a public key**. As the name suggests the private key is kept private, the public one is made public. Messages encrypted with one of the keys can only be decrypted with the other. We will now look at the most common ways to use this fact. |
| ==== Private Messages ==== | ==== Private Messages ==== | ||
| Line 17: | Line 17: | ||
| ==== Certificates ==== | ==== Certificates ==== | ||
| - | A possible solution for this are certificates. A is a document that contains your public key and other information about you. It has to be signed by a Certificate Authority (CA). With it's signature the Certificate Authority confirms that they checked your identity and the information in the certificate is valid. | + | A possible solution for this are certificates. A certificate |
| - | Obviously the certificate is useless without the private key belonging to it or once the private key got compromised. So make sure to protect your private key properly, nobody else should be able to get the file with it. | + | Obviously the certificate is useless without the private key belonging to it or once the private key got compromised. So make sure to protect your private key properly, nobody else should be able to get the file with it and you should not loose it. |
| ===== | ===== | ||
| Line 28: | Line 28: | ||
| CERN has its own Certificate Authority. You find its website under [[https:// | CERN has its own Certificate Authority. You find its website under [[https:// | ||
| + | |||
| + | ===== Obtaining a key-pair and certificate from CERN ===== | ||
| + | |||
| + | |||
| + | ==== New Certificate Authority ==== | ||
| + | - Request a [[https:// | ||
| + | - Follow [[https:// | ||
| + | |||
| + | |||
| + | |||
| + | =====other useful things ===== | ||
| + | |||
| + | ====print public key==== | ||
| + | from your private key you can generate the corresponding public key | ||
| + | openssl rsa -in privkey.pem -pubout | ||
| + | |||
| + | ====print certificate details==== | ||
| + | you can print all the information stored in your certificate | ||
| + | openssl x509 -text -noout -in certificate.pem | ||
| + | |||
| + | ==== create a pkcs12 file (used by web-browsers) ==== | ||
| + | (tested with Firefox and Opera) | ||
| + | To use the certificate for authentication on websites you need to combine the certificate and the private-key into a pkcs12 file | ||
| + | openssl pkcs12 -export -inkey privkey.pem -in certificate.cer -out combined.p12 | ||
| + | You can then import this file into the certificate configuration of your browser | ||
| + | (Firefox: edit > preferences > advanced > view certificates) | ||
| + | |||
| + | ==== export from a pkcs12 file==== | ||
| + | export the certificate | ||
| + | openssl pkcs12 -clcerts -nokeys -in combined.p12 -out certificat.pem | ||
| + | export the private key | ||
| + | openssl pkcs12 -nocerts -in combined.p12 -out privkey.pem | ||
| + | | ||
| + | if you work on a SLC machine, you can also use a special script for this: | ||
| + | cert-convert.sh combined.p12 | ||
| + | ===== Useful Links===== | ||
| + | * [[http:// | ||
| + | * [[http:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | ====== Outdated ====== | ||
| + | The explanation below is outdated. | ||
| + | CERN does not sign certificate requests for existing keys any longer. | ||
| + | You will have to generate a new pair with a private-key and certificate every year. | ||
| =====Getting Started (generate a first key pair and certificate) ===== | =====Getting Started (generate a first key pair and certificate) ===== | ||
| Line 42: | Line 86: | ||
| The next step is to get the certificate request signed by the Certificate Authority. | The next step is to get the certificate request signed by the Certificate Authority. | ||
| - | Select [[https:// | + | Select [[https:// |
| After you passed the identity check a from with one large text box will be shown to you. | After you passed the identity check a from with one large text box will be shown to you. | ||
| Copy and paste the content of myrequest.csr into the form. | Copy and paste the content of myrequest.csr into the form. | ||
| Line 66: | Line 110: | ||
| The next step is now again to [[https:// | The next step is now again to [[https:// | ||
| Again you get a signed certificate back and store it with a helpful name. | Again you get a signed certificate back and store it with a helpful name. | ||
| - | Probably you will then want to update your files in ~/.globus. | + | Probably you will then want to update your files in ~/.globus, so copy the **.cer** into that directory and replace the symlink for '' |
| - | =====other useful things ===== | ||
| - | |||
| - | ====print public key==== | ||
| - | from your private key you can generate the corresponding public key | ||
| - | openssl rsa -in privkey.pem -pubout | ||
| - | |||
| - | ====print certificate details==== | ||
| - | you can print all the information stored in your certificate | ||
| - | openssl x509 -text -noout -in certificate.pem | ||
| - | |||
| - | ==== create a pkcs12 file (used by web-browsers) ==== | ||
| - | (tested with Firefox and Opera) | ||
| - | To use the certificate for authentication on websites you need to combine the certificate and the private-key into a pkcs12 file | ||
| - | openssl pkcs12 -export -inkey privkey.pem -in certificate.cer -out combined.p12 | ||
| - | You can then import this file into the certificate configuration of your browser | ||
| - | (Firefox: edit > preferences > advanced > view certificates) | ||
| - | |||
| - | ==== export from a pkcs12 file==== | ||
| - | export the certificate | ||
| - | openssl pkcs12 -nokeys -in combined.p12 -out certificat.pem | ||
| - | export the private key | ||
| - | openssl pkcs12 -nocerts -in combined.p12 -out privkey.pem | ||
| - | |||
| - | |||
| - | ===== Useful Links===== | ||
| - | * [[http:// | ||
| - | * [[http:// | ||
cern/certificates.1317643292.txt.gz · Last modified: 2011/10/03 14:01 by nchiap
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial-Share Alike 4.0 International
