Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
ca [2025/04/12 10:46] jango |
ca [2025/06/01 01:36] (aktuell) jango [Test OCSP] |
||
---|---|---|---|
Zeile 3: | Zeile 3: | ||
=====1-Tier with CRL===== | =====1-Tier with CRL===== | ||
+ | Einfache 1-Tier Root CA mit [[CRL]] | ||
====Initialize Root CA==== | ====Initialize Root CA==== | ||
<code bash> | <code bash> | ||
Zeile 91: | Zeile 92: | ||
</ | </ | ||
- | ====Issue | + | ====Issue certificate==== |
<code bash> | <code bash> | ||
#!/bin/bash | #!/bin/bash | ||
Zeile 133: | Zeile 134: | ||
</ | </ | ||
- | ====Revoke | + | ====Revoke certificate==== |
<code bash> | <code bash> | ||
#!/bin/bash | #!/bin/bash | ||
Zeile 219: | Zeile 220: | ||
</ | </ | ||
- | =====1-Tier with OSCP===== | + | =====1-Tier with OCSP===== |
+ | Einfache 1-Tier Root CA mit [[OCSP]] Responder | ||
====Initialize Root CA==== | ====Initialize Root CA==== | ||
<code bash> | <code bash> | ||
Zeile 278: | Zeile 280: | ||
[ dn ] | [ dn ] | ||
- | C = DE | + | C = AT |
- | ST = Bayern | + | ST = Vienna |
- | L = München | + | L = Vienna |
- | O = MeineFirma | + | O = Brainworx |
- | CN = Meine Root CA | + | CN = Root CA |
[ v3_ca ] | [ v3_ca ] | ||
Zeile 346: | Zeile 348: | ||
openssl req -new -key " | openssl req -new -key " | ||
-out " | -out " | ||
- | -subj "/C=DE/ST=Bayern/O=MeineFirma/ | + | -subj "/C=AT/ST=Vienna/O=Brainworx/ |
# Zertifikat signieren | # Zertifikat signieren | ||
Zeile 399: | Zeile 401: | ||
echo " | echo " | ||
echo " | echo " | ||
- | </ | + | </code> |
+ | |||
+ | ====Initialize OCSP==== | ||
+ | < | ||
+ | # | ||
+ | |||
+ | set -e | ||
+ | |||
+ | CA_DIR=" | ||
+ | OCSP_NAME=" | ||
+ | OCSP_DIR=" | ||
+ | mkdir -p " | ||
+ | |||
+ | # Key erstellen | ||
+ | openssl genrsa -out " | ||
+ | |||
+ | # CSR | ||
+ | openssl req -new -key " | ||
+ | -out " | ||
+ | -subj "/ | ||
+ | |||
+ | # Zertifikat signieren | ||
+ | openssl ca -config " | ||
+ | -in " | ||
+ | -out " | ||
+ | -days 825 -extensions v3_ocsp -batch | ||
+ | |||
+ | echo " | ||
+ | echo " | ||
+ | </ | ||
+ | |||
+ | ====Start OCSP Server==== | ||
+ | <code bash> | ||
+ | # | ||
+ | |||
+ | set -e | ||
+ | |||
+ | CA_DIR=" | ||
+ | OCSP_NAME=" | ||
+ | OCSP_DIR=" | ||
+ | |||
+ | openssl ocsp \ | ||
+ | -port 8888 \ | ||
+ | -text \ | ||
+ | -index " | ||
+ | -CA " | ||
+ | -rkey " | ||
+ | -rsigner " | ||
+ | -nmin 1 | ||
+ | </ | ||
+ | |||
+ | |||
+ | ====Test OCSP==== | ||
+ | <code bash> | ||
+ | # | ||
+ | |||
+ | set -e | ||
+ | |||
+ | CA_DIR=" | ||
+ | SERVER=$1 | ||
+ | SERVER_CERT=" | ||
+ | |||
+ | URI=$(openssl x509 -in " | ||
+ | |||
+ | openssl ocsp \ | ||
+ | -issuer " | ||
+ | -cert " | ||
+ | -url $URI \ | ||
+ | -resp_text -noverify | ||
+ | </ | ||
+ | |||
+ | ====OCSP Service==== | ||
+ | |||
+ | Script als Service erstellen | ||
+ | < | ||
+ | sudo nano / | ||
+ | </ | ||
+ | |||
+ | < | ||
+ | [Unit] | ||
+ | Description=OpenSSL OCSP Responder | ||
+ | |||
+ | [Service] | ||
+ | Type=simple | ||
+ | ExecStart=/ | ||
+ | |||
+ | [Install] | ||
+ | WantedBy=multi-user.target | ||
+ | </code> |