SSL & Certificates

Requesting a new certificate

Certificates and keys are currently created on hyperion, in /root/openssl and stored in the directory corresponding to the year. They used to be created in a similar directory on james, but since james will be retired, this functionality has been migrated. The old directory was mirrored from james to hyperion and is kept on hyperion for backwards compatibility/reference. Futrue changes should be conducted from hyperion.

• generate an RSA private key (or use an existing key if the current one is not too old):

  • openssl genrsa -out <hostname>.key 3072

• create a certificate request (personen oder systemname = <hostname>). Optionally create and use a custom config in place of the generic one to set up alternate hostnames for a given certificate:

  • openssl req -new -config /root/openssl/openssl_pslab.conf -sha256 -key <hostname>.key -out <hostname>.csr

• go to DFN-PKI: UdS => Serverzertifikat (further informations: UdS-CA)

  • PKCS#10-Zertifikatantrag (PEM-formatierte Datei): <hostname>.csr

  • Ggf. einen neuen PIN generieren und eintragen/hinterlegen (für revocations)
  • Formular ausdrucken und unterschreiben.
• Der ausgedruckte Zertifikatsantrag muss persönlich beim HIZ (Geb. E1 2) vorgelegt werden (mit Perso zur Personenkontrolle)
  • Kontakt Stand 2018 ist Marc Luuk
• Sobald der Antrag geprüft wurde, wird das signierte Zertifikat per mail zugeteilt
  • Seriennummer hier archivieren (s.u.)

  • Das Zertifikat kommt als cert-<sn>.pem --> Umbenennen zu <hostname>.crt

  • Dann Installation wie unten beschrieben

Installing the certificate

The certificate consists of the following files:

• <hostname>.crt - The public part of the certificate

• <hostname>.key - The private part of the certificate

• uds-chain.pem - The signed chain of trust from the top-level CA to the HIZ CA: https://pki.pca.dfn.de/uni-des-saarlandes-ca/cgi-bin/pub/pki?cmd=getStaticPage;name=index;id=2 obtain via "save as" on Option "Zertifikatkette anzeigen".

• <hostname>.csr - The "certificate signing request" - this is only needed to create the certificate

To install the certificates you just need to copy them over to the right location. The public information (.crt and chain) goes to

• Centos: /etc/pki/tls/certs/

• Debian: /etc/ssl/pslab-certs/

the private information (.key) goes to

• Centos: /etc/pki/tls/private/

• Debian: /etc/ssl/pslab-private/

These locations are specified in the virtualhost configuration and can be changed there. The current placement is the CentOS default, though, so only change it if there is a really good reason to do so.

Configuration of which files are used as certificates and keys:

• Centos(hyperion,projects,courses): /etc/httpd/conf.d/ssl.conf

• Debian(james): /etc/apache2/sites-enabled/*_ssl

IMPORTANT: Change /etc/httpd/conf.d/ssl.conf to point to these three files (the chainfile has to be uncommented, the other two point to localhost.{key,crt} by default). A Setup for multiple certificates requries additional work (TODO).

TODO: How can apache read these files if they are root-readable only?

Testing

https://www.ssllabs.com/ssltest/ is useful to test the server for known vulnerabilities.

Self-signed certificates

If for some reason you need to create your own self-signed certificate you need to do the following:

1. Set up the CA environment (I'm not sure about the specifics. If you need to do this please elaborate on this)

   /etc/pki/tls/misc/CA -newca

2. /etc/pki/tls/misc/CA -newreq

   • To create a new Certification Request. Use the following Values (These should be the default values, as defined in /etc/ssl/openssl.cnf):
     • Country Name (2 letter code): DE
     • State or Province Name (full name): Saarland
     • Locality Name (eg, city): Saarbrucken
     • Organization Name (eg, company): Saarland University
     • Organizational Unit Name (eg, section): Programming Systems Lab

     • Common Name (eg, YOUR name): www.ps.uni-saarland.de

     • Email Address: webmaster@ps.uni-saarland.de

3. /etc/pki/tls/misc/CA -sign

   • To sign this request. If it fails with the error message 'TXT_DB error number 2' the you need to revoke the old key first.

4. openssl rsa -in newkey.pem -out newcert.key
   openssl x509 -in newcert.pem -out newcert.crt

   • To create private keys and certificates in the representation the web server needs them

For Reference

openssl_pslab.conf

• [req]
  distinguished_name         = req_distinguished_name
  req_extensions             = v3_req
  
  [req_distinguished_name]
  countryName                = Country Name (2 letter code)
  countryName_default        = DE
  
  ostateOrProvinceName        = Bundesland
  stateOrProvinceName_default = Saarland
  
  localityName               = Stadt
  localityName_default       = Saarbruecken
  
  rganizationName           = Name der Organisation
  organizationName_default   = Universitaet des Saarlandes
  
  organizationalUnitName     = Einrichtung oder Organisationeinheit (optional)
  organizationalUnitName_default     = Programming Systems Lab
  
  commonName                 = Personen oder Systemname
  
  emailAddress               = EMail Adresse
  emailAddress_default       = sysads@ps.uni-saarland.de
  
  [v3_req]
  basicConstraints = CA:FALSE

Active Certificates

The following certificates are definitely in use:

• CN:          alfred.ps.uni-saarland.de (alt. DNS: lists.ps.uni-saarland.de, www.ps.uni-saarland.de)
  request by:  Jonas Kaiser
  date:        2017-07-18
  valid until: 2019-07-09
  key/algo:    3072 bit RSA / sha256
  serial:      9146299634114099077039182055
               HEX: 1d:8d:a4:48:ac:ed:2d:33:18:a6:d0:e7
  machine:     alfred
  locations:   [hyperion]      /root/openssl/2017/alfred.ps.uni-saarland.de.crt
               [alfred] (*)    /etc/pki/tls/certs/alfred.ps.uni-saarland.de.crt

• CN:          hyperion.ps.uni-saarland.de
  request by:  Jonas Kaiser
  date:        2016-07-11
  valid until: 2019-07-09
  key/algo:    3072 bit RSA / sha256
  serial:      7779103955662057
               HEX: 1b:a3:0d:c7:f2:b4:e9
  machine:     hyperion
  locations:   [james]         /root/openssl/2016/hyperion.ps.uni-saarland.de.crt
               [hyperion]      /root/openssl/2016/hyperion.ps.uni-saarland.de.crt
               [hyperion] (*)  /etc/pki/tls/certs/hyperion.ps.uni-saarland.de.crt

• CN:          redmine.ps.uni-saarland.de
  request by:  Jonas Kaiser
  date:        2015-11-03
  valid until: 2018-11-02
  key/algo:    3072 bit RSA / sha256
  serial:      7415472369576862
               HEX: 1a:58:55:34:6e:2b:9e
  machine:     projects
  locations:   [james]         /root/openssl/2015/redmine.ps.uni-saarland.de.crt
               [hyperion]      /root/openssl/2015/redmine.ps.uni-saarland.de.crt
               [projects] (*)  /etc/pki/tls/certs/redmine.ps.uni-saarland.de.crt

• CN:          courses.ps.uni-saarland.de
  request by:  Jonas Kaiser
  date:        2015-11-03
  valid until: 2018-11-02
  key/algo:    3072 bit RSA / sha256
  serial:      7415472334763455
               HEX: 1a:58:55:32:5a:f5:bf
  machine:     courses
  locations:   [james]         /root/openssl/2015/courses.ps.uni-saarland.de.crt
               [hyperion]      /root/openssl/2015/courses.ps.uni-saarland.de.crt
               [courses] (*)   /etc/pki/tls/certs/courses.ps.uni-saarland.de.crt

• CN:          www.ps.uni-saarland.de
  request by:  Jonas Kaiser
  date:        2015-11-03
  valid until: 2018-11-02
  key/algo:    3072 bit RSA / sha256
  serial:      7415474361880601
               HEX: 1a:58:55:ab:2e:50:19
  machine:     james
  locations:   [james]         /root/openssl/2015/www.ps.uni-saarland.de.crt
               [hyperion]      /root/openssl/2015/www.ps.uni-saarland.de.crt
               [james] (*)     /etc/ssl/pslab-certs/www.ps.uni-saarland.de.crt  

The following certificates are still valid, and deployed on james, it is however not clear if they are still used ...

• CN:          gosa.ps.uni-saarland.de
  request by:  Jonas Kaiser
  date:        2015-11-03
  valid until: 2018-11-02
  key/algo:    3072 bit RSA / sha256
  serial:      7415476121738420
               HEX: 1a:58:56:14:13:9c:b4
  machine:     james
  locations:   [james]         /root/openssl/2015/gosa.ps.uni-saarland.de.crt
               [hyperion]      /root/openssl/2015/gosa.ps.uni-saarland.de.crt
               [james]         /etc/ssl/pslab-certs/gosa.ps.uni-saarland.de.crt
  NOTE:        current DNS-MAP: 134.96.186.242 (=hyperion)

• CN:          ldap.ps.uni-saarland.de
  request by:  Jonas Kaiser
  date:        2015-11-03
  valid until: 2018-11-02
  key/algo:    3072 bit RSA / sha256
  serial:      7415474354642401
               HEX: 1a:58:55:aa:bf:dd:e1
  machine:     james
  locations:   [james]         /root/openssl/2015/ldap.ps.uni-saarland.de.crt
               [hyperion]      /root/openssl/2015/ldap.ps.uni-saarland.de.crt
               [james]         /etc/ssl/pslab-certs/ldap.ps.uni-saarland.de.crt
  NOTE:        current DNS-MAP: 134.96.186.68 (=james)

• CN:          mail.ps.uni-saarland.de
  request by:  Jonas Kaiser
  date:        2015-11-03
  valid until: 2018-11-02
  key/algo:    3072 bit RSA / sha256
  serial:      7415476854104748
               HEX: 1a:58:56:3f:ba:a2:ac
  machine:     james
  locations:   [james]         /root/openssl/2015/mail.ps.uni-saarland.de.crt
               [hyperion]      /root/openssl/2015/mail.ps.uni-saarland.de.crt
               [james]         /etc/ssl/pslab-certs/mail.ps.uni-saarland.de.crt
  NOTE:        current DNS-MAP: 134.96.186.68 (=james)