Appendix D SSL Certificates for Secure Web (HTTPS)
The secure web server (HTTPS) requires SSL certificates in order to establish secure connections. These certificates are for the use of the web server. The HTTPS certificates are only required if HTTPS is enabled on the Network configuration page in the ValuPoint.
D.1 X.509 Auto-Certificate Generation
The ValuPoint will automatically generate X.509 certificates if no external certificates are found or could not be loaded correctly. These will be generated one time and saved in the Flash file system for subsequent reuse. When the self-generated X.509 certificates are in use, this will be indicated at the bottom of the Network configuration page.
If there is a need to delete the self-generated certificates, you can do so by logging in via FTP. Change directory to /FLASH0, then to .cfg. The two certificate files that were self-generated are ssl.cert and ssl.key.
D.2 External Certificates
There are three certificates that you must generate and upload to use SSL certificates other than the self-generated X.509 certificates.
The required certificates are as follows, and must use exactly these names.
|
ca.crt |
CA Root certificate in PEM format |
|
server.crt |
Server certificate in PEM format |
|
server.key |
Server private key in PEM format |
The content of each certificate file will look something like the screen shot below. If you require external certificates for your secure web server, the requirement was likely imposed by your IT department. They should be able to provide the necessary certificates for you. For globally accessed use, the Root CA would come from somebody like GoDaddy or DigiCert (formerly Symantec).
If external certificates were loaded successfully, that will be indicated at the bottom of the Network configuration page.
D.3 Certificate Generation Script (Linux)
The art and science of generating SSL certificates is beyond the scope of this document. An example SSL certificate generation script is provided here as a reference.
The following script, run on a Linux system with OpenSSL installed, will generate the three required SSL certificate files. It will generate a number of intermediate files as well - you don't need to upload them. Replace references to Control Solutions in this script with your own company name.
#!/bin/bash
echo hello
# This will create some self signed certs, using one master CA.
#
# these can be the webserver DNS name, or an IP address, however you access
# the resource, this needs to match.
if [ -z "$1"] || [ -z "$2"]; then
echo 'Usage: gen.sh <server-name> <client-name>'
echo ' <server-name> and <client-name> can be IP addresses'
echo ' or DNS names.'
exit 1
fi
SNAME=$1
CNAME=$2
#
# Bits for strength, 1024, 2048, 4096, etc.. (suggest 2k or 4k for web servers)
BITS=1024
#
# HASH - Options are sha256, sha512, sha1, md5
HASH="sha256"
SN=`date +%Y%m%d%H%M%S`
################
# below is the entry for the CRL
# Do not use http://www.csimn.com/crl.pem for production keys and certificates
# cat <<EOF >> extensions.cnf
# [ extensions_section ]
# crlDistributionPoints = URI:http://www.csimn.com/crl.pem
#
# basicConstraints = CA:FALSE
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# subjectAltName = DNS:${SNAME},IP:${SNAME}
# EOF
#################################################################
#################################################################
# first, lets generate some private keys...
openssl genrsa -out server.key ${BITS}
openssl genrsa -out client.key ${BITS}
# ok, and now the MAIN CA
openssl req -x509 -${HASH} -nodes -days 10000 -newkey rsa:${BITS} -keyout ca.key -out ca.crt -subj "/CN=Main CA Certificate/O=Control Solutions Inc./C=US/ST=Minnesota/L=St Paul"
######
#
# Create a CSR for both server and client
# Replace these values with one appropriate for your organization
openssl req -out server.csr -key server.key -new -subj "/CN=${SNAME}/O=Control Solutions Inc./C=US/ST=Minnesota/L=St Paul"
openssl req -out client.csr -key client.key -new -subj "/CN=${CNAME}/O=Control Solutions Inc./C=US/ST=Minnesota/L=St Paul"
#
#
######
# Sign the keys with the CA
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial ${SN}01 -out server.crt -${HASH}
openssl x509 -req -days 3650 -in client.csr -CA ca.crt -CAkey ca.key -set_serial ${SN}02 -out client.crt -${HASH}
# Create a windows file to import the client keys if needed in this format
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
# Create the client keys as a complete pem file if needed in this format
openssl pkcs12 -in client.p12 -out client-full.pem -clcerts
# mv -f server.key svrkey.pem
# mv -f server.crt svrcert.pem
# mv -f client.key clntkey.pem
# mv -f client.crt clntcert.pem
# cp -f ca.crt cacert.pem
####
# cleanup
# rm -f client.csr server.csr
#DLS 20160420
echo '***********************************************************'
echo '* WARNING: Do not use this script to generate production *'
echo '* keys and certificates. This script is for *'
echo '* demonstration purposes only. *'
echo '***********************************************************'
