【CA】Build a internal CA with Openssl and SoftHsm2 #80
Labels
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
Intro
SoftHSM is an implementation of a cryptographic store accessible through a PKCS #11 interface. It is being developed as a part of the OpenDNSSEC project. In this blog, i use softhsm to generate key pairs and use libp11 to make it was able to used by openssl.
In this case, we create two rsa keypairs in one softhsm slot, also you can let the issue ca to use another slot.
Requirements
0x00 prepare the env
All operations are done on Ubuntu 18.04, how to install those tools would not be described here. also suppose you already have the basics of ca. if not, Jamie provide a good tutorial in this part.
here is the example to enable pkcs11 engine for openssl .
also you can get this config file here and put them to the right place. Before replace them ,you need have bakup.
openssl.cnf
ssl.openssl.cnf
also, you need create some folder and files depends on the configuration.
here is my folder structure
0x01 init slots & init keys
Here is the terminal output
you can change the key length, id & label by yourself. in this case, we use
id:01for the root ca andid:02for issue ca.Here is the terminal output
0x02 create root ca certs
Here is the terminal output
openssl x509 -in certs/root.ca.cert.pem -noout -text0x03 create issue ca certs
Here is the terminal output
Here is the terminal output
Here is the terminal output
cat certs/issue.ca.cert.pem certs/root.ca.cert.pem > certs/spki.cert.pem openssl x509 -in certs/spki.cert.pem -noout -text0x04 create ssl certs
Don't forget to cahnge permission for private folder. eg.
chmod 400 privateHere is the terminal output
Here is the terminal output
Here is the terminal output
Here is the terminal output
0x05 install CA Certs to Host
in this case, i put those cert in my ubuntu 18.04
it's enough to non-interactive usage. but fot some web browser, maybe you still need to trust it manually. here is the example for firefox
0x06 write test code
cat certs/www.example.com.cert.pem certs/issue.ca.cert.pem certs/root.ca.cert.pem > combine.pem0x07 Conclusion
As for now, you already create a internal CA, also include SSL cert. it's enough for the interanl usage. and in this case , the main purpose is to use softhsm to store the private key , as you can see in this blog. you can create a key pairs with never extracted properties which it was stored in softhsm. softhsm is only a softhsm implement of HSM , the better way is to use real HSM in your production env. personally , i think it's enough for many case.
0x08 Resources
The text was updated successfully, but these errors were encountered: