Chapter 5

Enter PEM pass phrase: *****

Verifying - Enter PEM pass phrase: *****

-----

You are about to be asked to enter information that will be incorporated into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank

For some fields there will be a default value, If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [CA]:

State or Province Name (full name) [Ontario]: Locality Name (eg, city) [Toronto]: Organization Name (eg, company) [Xelerance]:

Organizational Unit Name (eg, section) [Support Staff]:

Common Name (eg, your name or your server's hostname) []:Xelerance Root CA Email Address []:ca@xelerance.com

Answers that appear in brackets are the defaults taken from the openssl.cnf configuration file. Run the following commands in the directory you specified for the dir option in the CA_default section of your openssl.cnf file:

#mkdir newcerts

#touch index.txt

#echo "01" > serial

The Common Name (CN) of your Certificate Authority must be unique. It is strongly recommended to specify Certificate Authority, CA, or Root CA in the CN to prevent accidentally re-using this Common Name. For example: CN=Xelerance Root CA.

Creating Host Certificates with Your Own CA

Now that we have our own CA, we can start handing out X.509 Certificates for our users (or rather for the hosts our users are using, since these certificates are host-based and not user-based). The first certificate we need to generate is for the IPsec gateway itself. In our case we will re-use the machine West for this.

# openssl req -newkey rsa:1024 -keyout west.key -out westReq.pem

The output looks similar to the CA we generated above. Next, we need to sign the host certificate with our CA. Because some clients do not like the human readable part before the actual certificate, we use the -noout option to suppress it:

# openssl ca -in westReq.pem -days 365 -out westCert.pem -notext -cert caCert.pem -keyfile caKey.pem

Using configuration from /opt/vpn/ssl//openssl.cnf Enter pass phrase for caKey.pem:

Check that the request matches the signature Signature ok

Certificate Details:

Serial Number: 1 (0x1)

123