Benutzer-Werkzeuge
ca
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
|
ca [2025/04/12 10:48] jango |
ca [2025/04/15 09:41] (aktuell) jango [OCSP Service] |
||
|---|---|---|---|
| Zeile 3: | Zeile 3: | ||
| =====1-Tier with CRL===== | =====1-Tier with CRL===== | ||
| + | Einfache 1-Tier Root CA mit [[CRL]] | ||
| ====Initialize Root CA==== | ====Initialize Root CA==== | ||
| <code bash> | <code bash> | ||
| Zeile 219: | Zeile 220: | ||
| </ | </ | ||
| - | =====1-Tier with OSCP===== | + | =====1-Tier with OCSP===== |
| + | Einfache 1-Tier Root CA mit [[OCSP]] Responder | ||
| ====Initialize Root CA==== | ====Initialize Root CA==== | ||
| <code bash> | <code bash> | ||
| Zeile 399: | Zeile 401: | ||
| echo " | echo " | ||
| echo " | echo " | ||
| + | </ | ||
| + | |||
| + | ====Initialize OCSP==== | ||
| + | <code bash> | ||
| + | #!/bin/bash | ||
| + | |||
| + | set -e | ||
| + | |||
| + | CA_DIR=" | ||
| + | OCSP_NAME=" | ||
| + | OCSP_DIR=" | ||
| + | mkdir -p " | ||
| + | |||
| + | # Key erstellen | ||
| + | openssl genrsa -out " | ||
| + | |||
| + | # CSR | ||
| + | openssl req -new -key " | ||
| + | -out " | ||
| + | -subj "/ | ||
| + | |||
| + | # Zertifikat signieren | ||
| + | openssl ca -config " | ||
| + | -in " | ||
| + | -out " | ||
| + | -days 825 -extensions v3_ocsp -batch | ||
| + | |||
| + | echo " | ||
| + | echo " | ||
| + | </ | ||
| + | |||
| + | ====Start OCSP Server==== | ||
| + | <code bash> | ||
| + | #!/bin/bash | ||
| + | |||
| + | set -e | ||
| + | |||
| + | CA_DIR=" | ||
| + | OCSP_NAME=" | ||
| + | OCSP_DIR=" | ||
| + | |||
| + | openssl ocsp \ | ||
| + | -port 8888 \ | ||
| + | -text \ | ||
| + | -index " | ||
| + | -CA " | ||
| + | -rkey " | ||
| + | -rsigner " | ||
| + | -nmin 1 | ||
| + | </ | ||
| + | |||
| + | |||
| + | ====Test OCSP==== | ||
| + | <code bash> | ||
| + | #!/bin/bash | ||
| + | |||
| + | set -e | ||
| + | |||
| + | URI=http:// | ||
| + | CA_DIR=" | ||
| + | |||
| + | SERVER=$1 | ||
| + | SERVER_CERT=" | ||
| + | |||
| + | openssl ocsp \ | ||
| + | -issuer " | ||
| + | -cert " | ||
| + | -url $URI \ | ||
| + | -resp_text -noverify | ||
| + | </ | ||
| + | |||
| + | ====OCSP Service==== | ||
| + | |||
| + | Script als Service erstellen | ||
| + | < | ||
| + | sudo nano / | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | [Unit] | ||
| + | Description=OpenSSL OCSP Responder | ||
| + | |||
| + | [Service] | ||
| + | Type=simple | ||
| + | ExecStart=/ | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=multi-user.target | ||
| </ | </ | ||
ca.1744447715.txt.gz · Zuletzt geändert: 2025/04/12 10:48 von jango
Seiten-Werkzeuge
Falls nicht anders bezeichnet, ist der Inhalt dieses Wikis unter der folgenden Lizenz veröffentlicht: CC Attribution-NoDerivatives 4.0 International
