OPC UA - uaExpert & Modbus Server Security Test

客戶端採用uaExpert
伺服器端採用Modbus Server
來做一些OPC UA的安全連線建立的測試，其中有包含利用openssl製作三階層的憑證方式
p.s 有錯誤的地方歡迎指正

Transcript

1. OPC Unified Architecture Shao-Cheng Huang Date : 20170313 1
2. Outline • Client interface • Server interface • Login using certificate • Communication using certificate • Install Openssl • Create CA-Signed certificate • Convert certificate format • Communication using CA-Signed certificate • Login using CA-Signed certificate • Client discovery by discovery server • Using Wireshark to capture the packets • openssl_root.cnf • openssl_inter.cnf 2
3. Client interface (1/2) • Use UaExpert Figure 1 – UaExpert interface 3
4. Client interface (2/2) • 在win7下， UaExpert 管理憑證的路徑 C:\Users\cheng\AppData\Roaming\unifiedautomation\uaexpert\PKI • 其中管理憑證的資料夾有issuers、own、rejected、tls_issuers、 trusted • Issuers : opc.tcp憑證的簽發來源 • Own : UaExpert自己所存放的憑證和私密金鑰 • Rejected : UaExpert 拒絕server的憑證所存放的位置 • Tls_issuers : https憑證的簽發來源 • Trusted : UaExpert 信任server的憑證所存放的位置 4
5. Server interface (1/3) • Use Prosys OPC UA Modbus Server Figure 2 – Prosys OPC UA Modbus Server interface 5
6. Server interface (2/3) • 在win7下， Modbus 管理憑證的路徑 C:\ProgramData\ProsysOPC\ModbusServer • 其中管理PKI、 USERS_PKI • PKI : 用來管理進行連線的憑證 • Certs : Modbus 信任的client憑證所存放的位置 • Crl : Modbus 對簽發Client的CA，索取Certificate revocation list • Private : Modbus自己所存放的憑證和私密金鑰 • Rejected : Modbus 所拒絕的client憑證 • USERS_PKI : 用來管理登入的憑證 • Certs : Modbus 信任的client憑證 • Crl : Modbus 對簽發Client的CA，索取Certificate revocation list • Rejected : Modbus 所拒絕的client憑證 6
7. Server interface (3/3) Figure 3 - Prosys OPC UA Modbus Architecture • OPC UA Modbus Server is providing access to Modbus devices • Information security is built-in to OPC UA communications 7
8. Login using certificate • 利用Client的本機上擁有的憑證和私密金鑰，來當作帳號密碼來登 入 • 首先會先測試利用uaExpert安裝軟體自己就會產生的憑證和私密 金鑰來登入(uaexpert.der、 uaexpert_key.pem) • 再來會利用CA signed的憑證(使用opnssl製作的憑證)來登入 8
9. Login using certificate (1/8) 9 Client Server Login • 打開Modbus Server，下左圖的Running代表Modbus Server正常開啟 • 下右圖必須先打開Expert Mode，才看得到所有模式，在Users設定Server允許的登入方式
10. Login using certificate (2/8) Client Server Login 10 • 打開uaExpert，連線設定， 可以參考之後的Client discovery by discovery server • Certificate 預設存放的位置 : C:\Users\cheng\AppData \Roaming\unifiedautomation \uaexpert\PKI\own\certs \uaexpert.der • Private Key 預設存放的位置 : C:\Users\cheng\AppData\Roaming \unifiedautomation\uaexpert\PKI \own\private\uaexpert_key.pem
11. Login using certificate (3/8) • UaExpert對 Server進行連線 11 Client Server Login
12. Login using certificate (4/8) 12 • 此時Server送來Server的憑 證 • UaExpert會出現右畫面， 按下Trust Server Certificate， 便可把Server列為可信任 Client Server Login
13. Login using certificate (5/8) 13 • 收到BadIdentityTokenRejected的 回應，因為UaExpert登錄用的憑證被 Server所拒絕，所以要去Server的 拒絕資料夾下(C:\ProgramData\ProsysOPC \ModbusServer\USERS_PKI\CA\rejected) ，把UaExpert的憑證複製到信任的資料 夾下(C:\ProgramData\ProsysOPC\ ModbusServer\USERS_PKI\CA\certs) Client Server Login
14. Login using certificate (6/8) 14 ①剪下、②貼上 Client Server Login
15. Login using certificate (7/8) 15 • UaExpert再對Server 進行連線 Client Server Login
16. Private Key Certificate Trust List Private Key Certificate Trust List Login using certificate (8/8) 16 Application Instance Application Instance Communication Administrator Update User Figure 4 – Certificate handling Client Server Login
17. Communication using certificate (1/6) Client Server connection 17 • uaExpert對Modbus Server進行連線，採用有 加密過程的連線方法， 因為在連線時Server會傳給 Client他自己所提供的加密 方法，Client可以自己選擇 想要哪一種加密方式 • Sign : 對資料做簽章，使 得資料保有完整性和不可否 認性 Encrypt : 對資料進行加密， 使得資料有保密性
18. Communication using certificate (2/6) 18 • Basic256、Basic128所對應的加密演算法 Client Server connection
19. Communication using certificate (3/6) 19 • UaExpert對Server 進行連線 Client Server connection
20. 20 Communication using certificate (4/6) • UaExpert收到 BadSercurityChecksFailed， 表示Server與Client互相進行 的安全連線失敗了，因為 Server拒絕了Client的憑證 Client Server connection
21. Communication using certificate (5/6) • Modbus把Client的憑證設為Trust 21 Client Server connection
22. Communication using certificate (6/6) • UaExpert再對Server 進行連線 22 Client Server connection
23. Install Openssl (1/2) • 在這個網站下載 : https://slproweb.com/products/Win32OpenSSL.html • 支援Window作業系統，選擇位元數，我是下載Win64 OpenSSL v1.0.2k，我的作業系統為Win7 64bits 23
24. Install Openssl (2/2) • 安裝完後，要設定環境變數， 把C:\OpenSSL-Win64\bin (依照自己的openssl 路徑) 加入到環境變數 • Openssl是一個C語言的開放原 始碼，實作了基本的加密功能， 和SSL與TLS，也提供X509憑證的 製作 24 ① ② ③ ④ ⑤ ⑥ ⑦
25. Create CA-Signed certificate • 要簽一個三階層的憑證， 1. 首先要自簽(Self-Signed)一個最高層(root)的 憑證 2. 再利用最高層(root)的憑證簽發中間層(Intermediate)的憑證 3. 再利用中間層(Intermediate)的憑證簽發Server的憑證 • 簽發的意義就是代表上一層(假設是root CA)，承認了下一層(假設是 Intermediate CA)是可信任的，如果上一層想反悔已簽發的下一層，那麼他會有 一個清單(Certificate Revoke Lists)，上面記錄了所有被上一層註銷過的下一層憑證。 • 由於Root CA已經是最高層了，所以他沒有上一層，那麼他就只能自己簽發給自己了。Root CA因 為是最高權限，不希望有人隨意去對他申請簽發，所以希望藉由只簽發幾個信任的Intermediate CA，讓Intermediate CA可以簽發給其他Application (Server)。 25 Root CA Intermediate CA Server 簽發 簽發 Root CA 憑證 Intermediate CA 憑證 Server 憑證 擁有
26. Create CA-Signed certificate 1. Create Self-Signed certificate : 要先建一個Root CA的憑證 1. 用系統管理員執行cmd.exe 2. 先在桌面上創一個資料夾 # cd C:\Users\cheng\Desktop # mkdir x509Test # cd x509Test 3. 創建所需要的資料夾 # mkdir certs crl newcerts private # fsutil file createnew index.txt 0 # echo 1000 > serial # echo 1000 > crlnumber 4. 設定設定檔 openssl.cnf 1. 把openssl_root.cnf重新命名為openssl.cnf，並把它放在C:\Users\cheng\Desktop\x509Test目錄下 5. 創造Root CA的私密金鑰，這把ca.key.pem私密金鑰長度有4096bits，且有用AES 256加密，所以需要密碼 # openssl genrsa -aes256 -out private/ca.key.pem 4096 26 Password input Password input again
27. Create CA-Signed certificate 1. Create Self-Signed certificate : 要先建一個Root CA的憑證 6. 利用ca.key.pem自簽(Self-Signed)一個憑證，需要填些申請書，輸出憑證ca.cert.pem，有效天數7300天，根 據openssl.cnf設定檔產生 # openssl req -config openssl.cnf -key private/ca.key.pem -new -x509 -days 7300 -sha256 -extensions v3_ca -out certs/ca.cert.pem 7. 觀看憑證，看格式有無錯誤 # openssl x509 -noout -text -in certs/ca.cert.pem 27 GB English London Alice Ltd CSIE Alice Ltd Root CA 可跳過 ca.key.pem 密碼
28. Create CA-Signed certificate 28 因為是自簽所以，Issuer和Subject會一樣 Certificate revoke lists (CRL)可以存取的網址 DNS的uri 1. Create Self-Signed certificate : 要先建一個Root CA的憑證 7. 觀看憑證，看格式有無錯誤
29. Create CA-Signed certificate 2. Create Intermediate certificate : 利用Root CA的憑證簽發一個Intermediate 憑證 1. 創建一個屬於Intermediate 的資料夾、所需要的子資料夾和用於計算CRL的數量crlnumber # mkdir intermediate # cd intermediate # mkdir certs crl csr newcerts private # fsutil file createnew index.txt 0 # echo 1000 > serial # echo 1000 > crlnumber 2. 設定設定檔 openssl.cnf 1. 把openssl_inter.cnf丟進intermediate資料夾下，並把此設定檔重新命名為openssl.cnf 3. 創造Intermediate CA的私密金鑰，這把intermediate.key.pem私密金鑰長度有4096bits，且有用AES 256加密， 回到x509Test目錄下 # cd .. # openssl genrsa -aes256 -out intermediate/private/intermediate.key.pem 4096 29 Password input Password input again
30. Create CA-Signed certificate 2. Create Intermediate certificate : 利用Root CA的憑證簽發一個Intermediate 憑證 4. 利用intermediate.key.pem製作申請書，輸出檔為intermediate.csr.pem，根據intermediate/openssl.cnf設定檔 產生 # openssl req -config intermediate/openssl.cnf -new -sha256 -key intermediate/private/intermediate.key.pem - out intermediate/csr/intermediate.csr.pem 5. 利用ca.key.pem來簽發 intermediate.csr.pem申請書，產生出intermediate.cert.pem憑證，含有數位簽章 # openssl ca -config openssl.cnf -extensions v3_intermediate_ca -days 3650 -notext -md sha256 -in intermediate/csr/intermediate.csr.pem -out intermediate/certs/intermediate.cert.pem 30 intermediate.key.pem 密碼 GB English London Alice Ltd CSIE Alice Ltd Intermediate CA 可跳過
31. Create CA-Signed certificate 31 ca.key.pem密碼 y y 2. Create Intermediate certificate : 利用Root CA的憑證簽發一個Intermediate 憑證 5. 利用ca.key.pem來簽發 intermediate.csr.pem申請書，產生出intermediate.cert.pem憑證
32. Create CA-Signed certificate 2. Create Intermediate certificate : 利用Root CA的憑證簽發一個Intermediate 憑證 6. 觀看憑證，看格式有無錯誤 # openssl x509 -noout -text -in intermediate/certs/intermediate.cert.pem 7. 確認intermediate憑證的數位簽章是否與root CA的憑證資訊相符 # openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate.cert.pem 8. 創造一個CA的鏈結，利用Notepad++，呈現linux中cat的功能 # cat intermediate/certs/intermediate.cert.pem certs/ca.cert.pem > intermediate/certs/ca-chain.cert.pem 32
33. Create CA-Signed certificate 3. Create Server certificate :利用Intermediate的憑證簽發一個Server的憑證 1. 創造Server的私密金鑰，這把server.key.pem私密金鑰長度有2048bits，且有用AES 256加密，所以需要密碼 (如果不需要將私密金鑰設密碼，就將-aes256去掉) # openssl genrsa -aes256 -out intermediate/private/server.key.pem 2048 2. 利用intermediate/openssl.cnf此設定檔，製作一個申請書，Server的Common Name必須和DNS或IP位置一樣 # openssl req -config intermediate/openssl.cnf -key intermediate/private/server.key.pem -new -sha256 -out intermediate/csr/server.csr.pem 33 Password input Password input again US California Mountain View Alice Ltd Alice Ltd Web Services 192.168.0.102 server.key.pem Password
34. Create CA-Signed certificate 34 3. Create Server certificate :利用Intermediate的憑證簽發一個Server的憑證 3. 需要修改設定檔intermediate/openssl.cnf中， Server DNS的部分，將內容改為跟Common Name一樣 4. 設定檔為intermediate/openssl.cnf， 利用intermediate.key.pem來簽發 server的申請書 # openssl ca -config intermediate/openssl.cnf -extensions server_cert -days 375 -notext -md sha256 -in intermediate/csr/server.csr.pem -out intermediate/certs/server.cert.pem intermediate.key.pem密碼 y y same Fig 1. intermediate/openssl.cnf content
35. Create CA-Signed certificate 35 3. Create Server certificate :利用Intermediate的憑證簽發一個Server的憑證 4. 觀看憑證，看格式有無錯誤 # openssl x509 -noout -text -in intermediate/certs/server.cert.pem 5. 確認Server憑證的數位簽章是否與CA連結的憑證資訊相符 # openssl verify -CAfile intermediate/certs/ca-chain.cert.pem intermediate/certs/server.cert.pem
36. Create CA-Signed certificate 4. Create Certificate revocation lists : 製作Root CA的憑證註銷清單 1. 先隨便製作一個intermediate CA的憑證，放在intermediate/certs目錄下 # openssl genrsa -out intermediate/private/intermediate2.key.pem 2048 # openssl req -config intermediate/openssl.cnf -new -sha256 -key intermediate/private/intermediate2.key.pem - out intermediate/csr/intermediate2.csr.pem # openssl ca -config openssl.cnf -extensions v3_intermediate_ca -days 3650 -notext -md sha256 -in intermediate/csr/intermediate2.csr.pem -out intermediate/certs/intermediate2.cert.pem # openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate2.cert.pem 2. 註銷intermediate2.cert.pem這個憑證，會看到index.txt，會有註銷的紀錄(R)，而V則是代表生效 # openssl ca -config openssl.cnf -revoke intermediate/certs/intermediate2.cert.pem 36
37. Create CA-Signed certificate 4. Create Certificate revocation lists : 製作Root CA的憑證註銷清單 3. 製作Certificate revocation lists(CRL)，產生ca.crl.pem的CRL檔，把CRL放到crl的目錄下 # openssl ca -config openssl.cnf -gencrl -out crl/ca.crl.pem 4. 觀看CRL # openssl crl -in crl/ca.crl.pem -noout -text 37 ca.key.pem密碼
38. Create CA-Signed certificate 5. Create Certificate revocation lists : 製作Intermediate CA的憑證註銷清單 1. 先隨便製作一個憑證，放在intermediate/certs目錄下 # openssl genrsa -out intermediate/private/bob@example.com.key.pem 2048 # openssl req -new -key intermediate/private/bob@example.com.key.pem -out intermediate/csr/bob@example.com.csr.pem # openssl ca -config intermediate/openssl.cnf -extensions usr_cert -notext -md sha256 -in intermediate/csr/bob@example.com.csr.pem -out intermediate/certs/bob@example.com.cert.pem # openssl verify -CAfile intermediate/certs/ca-chain.cert.pem intermediate/certs/bob@example.com.cert.pem 2. 註銷bob@example.com.cert.pem這個憑證，會看到intermediate/index.txt，會有註銷的紀錄(R) # openssl ca -config intermediate/openssl.cnf -revoke intermediate/certs/bob@example.com.cert.pem 38
39. Create CA-Signed certificate 39 5. Create Certificate revocation lists : 製作Intermediate CA的憑證註銷清單 3. 製作Certificate revocation lists # openssl ca -config intermediate/openssl.cnf -gencrl -out intermediate/crl/intermediate.crl.pem 4. 觀看CRL # openssl crl -in intermediate/crl/intermediate.crl.pem -noout -text intermediate.key.pem密碼
40. Convert certificate format • 有一個網站可以把憑證PEM轉成DER檔，https://www.sslshopper.com/ssl-converter.html • 把之前產生的ca.cert.pem、intermediate.cert.pem、server.cert.pem轉成der檔並放回原資料 夾 • 將intermediate.crl.pem轉成.crl格式 # openssl crl -inform PEM -in intermediate.crl.pem -outform DER -out intermediate.crl • 將私密金鑰解密 # openssl rsa -in intermediate/private/server.key.pem -out intermediate/private/server.key.pem • OPC UA的軟體 (uaExpert、Modbus Server)不會讀取被加密的私密金鑰，所以要先把私密金 鑰解密才能讀取 40
41. Convert certificate format • 用文字編輯器開啟私密金鑰的檔案，下左圖是server.key.pem，會發現有ENCRYPTED的字樣 代表有加密過，而下右圖是經由openssl解密過後的server.key.pem 41
42. Communication using CA-Signed certificate • 利用Modbus server和uaExpert來做測試 • 先將server.cert.der和server.key.pem複製到 C:\ProgramData\ProsysOPC\ModbusServer\PKI\CA\private下，並將兩個檔案的名稱分別改為 ModbusServer@cheng-PC.der和ModbusServer@cheng-PC.pem • 開啟Prosys OPC UA Modbus Server和UaExpert，並用UaExpert對Modbus Server進行連線 42
43. Communication using CA-Signed certificate • 會得到此畫面，因為uaExpert未得到簽發給sever憑證的上層所有憑證和上層每一層都各自 擁有的CRL。因為Client要信任Server也要信任簽給Server的CA，且CA有沒有註銷掉Server的 憑證 43
44. Communication using CA-Signed certificate • 所以要把前面做的ca.cert.der、intermediate.cert.der放到簽發者的目錄下， C:\Users\cheng\AppData\Roaming\unifiedautomation\uaexpert\PKI\issuers\certs 44
45. Communication using CA-Signed certificate • 再將ca.crl.pem放入 C:\Users\cheng\AppData\Roaming\unifiedautomation\uaexpert\PKI\issuers\crl • 把intermediate.crl.pem放入 C:\Users\cheng\AppData\Roaming\unifiedautomation\uaexpert\PKI\trusted\crl 45 Click
46. Login using CA-Signed certificate • 使用server憑證來登入時，上層的憑證都必須先加入到Modbus Server 的Trust資料夾中。以 前面的為例，必須把ca.cert.der、intermediate.cert.der放入Modbus Server 登入所用憑證資料 夾的trusted裡C:\ProgramData\ProsysOPC\ModbusServer\USERS_PKI\CA\certs • 因為Server要信任Client的憑證，必須要得信任簽發給Client的CA憑證。且如果一個軟體把某 CA設為信任後，那麼之後那個CA簽發給其他Server，這些Server其實都已經都算是可信任的。 • Modbus Server也有CRL的資料夾C:\ProgramData\ProsysOPC\ModbusServer\USERS_PKI\CA\crl 46 Server.cert.der ca.cert.der intermediate.cert.der
47. Login using CA-Signed certificate 47
48. Client discovery by discovery server (1/6) • 解壓縮opc-ua-1.02-lds-setup-335.1-20150126.zip • 安裝OPC UA Local Discovery Server 1.02.msi 48
49. Client discovery by discovery server (2/6) • OPC UA Local Discovery Server，也有憑證目錄，在C:\ProgramData\OPC Foundation\UA\Discovery\pki下，管理crl、issuer、own、rejected和trusted資料夾 49
50. Client discovery by discovery server (3/6) • 將Modbus Server註冊到local discovery server(LDS)，LDS預設port為4840 50 ① ② ③ 重新開啟
51. Client discovery by discovery server (4/6) • 要去C:\ProgramData\OPC Foundation\UA\Discovery\pki\rejected下 把剛剛註冊到LDS的server憑證複製貼上到C:\ProgramData\OPC Foundation\UA\Discovery\pki\trusted\certs下 • 在重新開啟Modbus Server 51
52. Client discovery by discovery server (5/6) • 利用uaExpert對LDS找尋Server，會搜尋到註冊在LDS上的Server，點開展覽 52
53. Client discovery by discovery server (6/6) • 點開ModbusServer@cheng-PC (opc.tcp)，就代表已經對Server連線了，Server傳送本身提供哪 些Sercurity機制給Client 53
54. Using Wireshark to capture the packets • 在這個網頁下載Wireshark : https://www.wireshark.org/download.html • 安裝Wireshark，且盡量安裝所有Tool(包含Winpcap) 54
55. Using Wireshark to capture the packets • 設定Wireshark，點開上列的Edit ，再點Preference 55
56. Using Wireshark to capture the packets • 點開Protocols 56
57. Using Wireshark to capture the packets • 移到OpcUa所在的地方，更改OPC UA TCP Ports的欄位，值改成Server的port 57
58. openssl_root.cnf (1/3) # OpenSSL root CA configuration file. # Copy to `/root/ca/openssl.cnf`. [ ca ] # `man ca` default_ca = CA_default [ CA_default ] # Directory and file locations. dir = . certs = $dir/certs crl_dir = $dir/crl new_certs_dir = $dir/newcerts database = $dir/index.txt serial = $dir/serial RANDFILE = $dir/private/.rand # The root key and root certificate. private_key = $dir/private/ca.key.pem certificate = $dir/certs/ca.cert.pem # For certificate revocation lists. crlnumber = $dir/crlnumber crl = $dir/crl/ca.crl.pem crl_extensions = crl_ext default_crl_days = 30 # SHA-1 is deprecated, so use SHA-2 instead. default_md = sha256 name_opt = ca_default cert_opt = ca_default default_days = 375 preserve = no policy = policy_strict 58
59. openssl_root.cnf (2/3) [ policy_strict ] # The root CA should only sign intermediate certificates that match. # See the POLICY FORMAT section of `man ca`. countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_loose ] # Allow the intermediate CA to sign a more diverse range of certificates. # See the POLICY FORMAT section of the `ca` man page. countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] # Options for the `req` tool (`man req`). default_bits = 2048 distinguished_name = req_distinguished_name string_mask = utf8only # SHA-1 is deprecated, so use SHA-2 instead. default_md = sha256 # Extension to add when the -x509 option is used. x509_extensions = v3_ca [ req_distinguished_name ] # See <https://en.wikipedia.org/wiki/Certificate_signing_request>. countryName = Country Name (2 letter code) stateOrProvinceName = State or Province Name localityName = Locality Name 0.organizationName = Organization Name organizationalUnitName = Organizational Unit Name commonName = Common Name emailAddress = Email Address # Optionally, specify some defaults. countryName_default = GB stateOrProvinceName_default = England localityName_default = London 0.organizationName_default = Alice Ltd organizationalUnitName_default = CSIE emailAddress_default = 59
60. openssl_root.cnf (3/3) [ v3_ca ] # Extensions for a typical CA (`man x509v3_config`). subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:true keyUsage = critical, digitalSignature, cRLSign, keyCertSign subjectAltName = @alternate_names crlDistributionPoints = URI:http://127.0.0.1/intermediate.crl.pem [ v3_intermediate_ca ] # Extensions for a typical intermediate CA (`man x509v3_config`). subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:true, pathlen:0 keyUsage = critical, digitalSignature, cRLSign, keyCertSign [ usr_cert ] # Extensions for client certificates (`man x509v3_config`). basicConstraints = CA:FALSE nsCertType = client, email nsComment = "OpenSSL Generated Client Certificate" subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment extendedKeyUsage = clientAuth, emailProtection [ server_cert ] # Extensions for server certificates (`man x509v3_config`). basicConstraints = CA:FALSE nsCertType = server nsComment = "OpenSSL Generated Server Certificate" subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer:always keyUsage = critical, digitalSignature, keyEncipherment extendedKeyUsage = serverAuth [ crl_ext ] # Extension for CRLs (`man x509v3_config`). authorityKeyIdentifier=keyid:always [ alternate_names ] DNS.1 = www.example.com [ ocsp ] # Extension for OCSP signing certificates (`man ocsp`). basicConstraints = CA:FALSE subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer keyUsage = critical, digitalSignature 60
61. openssl_inter.cnf (1/3) # OpenSSL intermediate CA configuration file. # Copy to `/root/ca/intermediate/openssl.cnf`. [ ca ] # `man ca` default_ca = CA_default [ CA_default ] # Directory and file locations. dir = ./intermediate certs = $dir/certs crl_dir = $dir/crl new_certs_dir = $dir/newcerts database = $dir/index.txt serial = $dir/serial RANDFILE = $dir/private/.rand # The root key and root certificate. private_key = $dir/private/intermediate.key.pem certificate = $dir/certs/intermediate.cert.pem # For certificate revocation lists. crlnumber = $dir/crlnumber crl = $dir/crl/intermediate.crl.pem crl_extensions = crl_ext default_crl_days = 30 # SHA-1 is deprecated, so use SHA-2 instead. default_md = sha256 name_opt = ca_default cert_opt = ca_default default_days = 375 preserve = no policy = policy_loose # Extension copying option: use with caution. copy_extensions = copy 61
62. openssl_inter.cnf (2/3) [ policy_strict ] # The root CA should only sign intermediate certificates that match. # See the POLICY FORMAT section of `man ca`. countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_loose ] # Allow the intermediate CA to sign a more diverse range of certificates. # See the POLICY FORMAT section of the `ca` man page. countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] # Options for the `req` tool (`man req`). default_bits = 2048 distinguished_name = req_distinguished_name string_mask = utf8only # SHA-1 is deprecated, so use SHA-2 instead. default_md = sha256 # Extension to add when the -x509 option is used. x509_extensions = v3_ca [ req_distinguished_name ] # See <https://en.wikipedia.org/wiki/Certificate_signing_request>. countryName = Country Name (2 letter code) stateOrProvinceName = State or Province Name localityName = Locality Name 0.organizationName = Organization Name organizationalUnitName = Organizational Unit Name commonName = Common Name emailAddress = Email Address # Optionally, specify some defaults. countryName_default = GB stateOrProvinceName_default = England localityName_default = London 0.organizationName_default = Alice Ltd organizationalUnitName_default = CSIE emailAddress_default = 62
63. openssl_inter.cnf (3/3) [ v3_ca ] # Extensions for a typical CA (`man x509v3_config`). subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:true keyUsage = critical, digitalSignature, cRLSign, keyCertSign, keyEncipherment subjectAltName = @alternate_names [ v3_intermediate_ca ] # Extensions for a typical intermediate CA (`man x509v3_config`). subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:true, pathlen:0 keyUsage = critical, digitalSignature, cRLSign, keyCertSign crlDistributionPoints = URI:http://127.0.0.1/intermediate.crl.pem subjectAltName = @alternate_names [ usr_cert ] # Extensions for client certificates (`man x509v3_config`). basicConstraints = CA:FALSE nsCertType = client, email nsComment = "OpenSSL Generated Client Certificate" subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment extendedKeyUsage = clientAuth, emailProtection crlDistributionPoints = URI:http://127.0.0.1/intermediate.crl.pem subjectAltName = @alternate_names [ server_cert ] # Extensions for server certificates (`man x509v3_config`). basicConstraints = CA:FALSE nsCertType = server nsComment = "OpenSSL Generated Server Certificate" subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer:always keyUsage = critical, digitalSignature, keyEncipherment extendedKeyUsage = serverAuth crlDistributionPoints = URI:http://127.0.0.1/intermediate.crl.pem subjectAltName = @alternate_names [ crl_ext ] # Extension for CRLs (`man x509v3_config`). authorityKeyIdentifier=keyid:always [ alternate_names ] DNS.1 = 192.168.0.102 [ ocsp ] # Extension for OCSP signing certificates (`man ocsp`). basicConstraints = CA:FALSE subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer keyUsage = critical, digitalSignature extendedKeyUsage = critical, OCSPSigning 63
64. THANK YOU. 64