<html>
<head>
<meta content="text/html; charset=iso-8859-2"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Gyu, <br>
So as i get this all right, i have to do the following on the
server: <br>
generate the certificate for the CA:<br>
<meta http-equiv="content-type" content="text/html;
charset=iso-8859-2">
<strong style="font-weight: normal; color: rgb(0, 0, 0);
font-family: Courier, fixed; font-size: 16px; font-style: normal;
font-variant: normal; letter-spacing: normal; line-height: 24px;
orphans: auto; text-align: left; text-indent: 0px; text-transform:
none; white-space: normal; widows: 1; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255);">openssl req -new -x509 -keyout private/cakey.pem -out
cacert.pem -days 365 -config openssl.cnf<br>
</strong>Create the server certificate and sign a certificate for
the server:<br>
<meta http-equiv="content-type" content="text/html;
charset=iso-8859-2">
<strong style="font-weight: normal; color: rgb(0, 0, 0);
font-family: Courier, fixed; font-size: 16px; font-style: normal;
font-variant: normal; letter-spacing: normal; line-height: 24px;
orphans: auto; text-align: left; text-indent: 0px; text-transform:
none; white-space: normal; widows: 1; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255);">openssl req -nodes -new -x509 -keyout serverkey.pem -out
serverreq.pem -days 365 -config openssl.cnf<br>
openssl x509 -x509toreq -in serverreq.pem -signkey serverkey.pem
-out tmp.pem<br>
openssl ca -config openssl.cnf -policy policy_anything -out
servercert.pem -infiles tmp.pem<br>
</strong><br>
On the Client:<br>
Copy <b>cacert.pem</b> from the server to the client<br>
Create a client certificate:<br>
<meta http-equiv="content-type" content="text/html;
charset=iso-8859-2">
<meta http-equiv="content-type" content="text/html;
charset=iso-8859-2">
<strong style="font-weight: normal; color: rgb(0, 0, 0);
font-family: Courier, fixed; font-size: 16px; font-style: normal;
font-variant: normal; letter-spacing: normal; line-height: 24px;
orphans: auto; text-align: left; text-indent: 0px; text-transform:
none; white-space: normal; widows: 1; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255);">openssl req -nodes -new -x509 -keyout clientkey.pem -out
clientreq.pem -days 365 -config openssl.cnf<br>
openssl x509 -x509toreq -in clientreq.pem -signkey clientkey.pem
-out tmp.pem<br>
openssl ca -config openssl.cnf -policy policy_anything -out
clientcert.pem -infiles tmp.pem<br>
</strong>And than just link the cacert.pem and in the ca.d put the
servercert.pem file ?<br>
<br>
<br>
And on the Server site copy the clientcert.pem file to ca.d ?<br>
<br>
Kind regards<br>
Ivan<br>
<meta http-equiv="content-type" content="text/html;
charset=iso-8859-2">
<div class="moz-cite-prefix">
<meta http-equiv="content-type" content="text/html;
charset=iso-8859-2">
<br>
On 01/15/2016 11:42 AM, PÁSZTOR György wrote:<br>
</div>
<blockquote
cite="mid:20160115104258.GA10330@linux.gyakg.u-szeged.hu"
type="cite">
<pre wrap="">Hi,
"Ivan Adji - Krstev" <a class="moz-txt-link-rfc2396E" href="mailto:akivanradix@gmail.com"><akivanradix@gmail.com></a> írta 2016-01-15 11:18-kor:
</pre>
<blockquote type="cite">
<pre wrap="">You mean the cacert.pem or the servercert.pem ? and vice versa ?
</pre>
</blockquote>
<pre wrap="">
The servercert.pem is the cert pair for the key what the server has.
The (server)cert is the "public" part of the key, and the key file is the
private part.
The servercert is signed with the cacert. As far as I saw your example, you
defined different CA for signing the servercert, and do that separately to
sign the client's cert.
So the ca, what you have created to sign the server's csr (so, after the
signing it become a cert), is the one which should be published to the
client side ca dir.
So when the tls handshake happens, the client sees that whups, here is a
server cert. Cheks in the cert the issuer's fingerprint.
Based on the fingerprint it will find the CA's cert in it's local ca dir.
Check if that signature is valid, and client is happy.
The same will happen on the server side simmetrically:
The client will show up its own cert.
The server sees, it is signed with the other ca. (The one, which you used
to sign the client cert.)
Based on the fingerprint, it start to check if it is available in its ca
dir.
If you install that there, and the appropriate symlink is also available,
then it will also find that ca cert. It will check if the client
certificate is valid.
It will be.
Both side will be happy, and communicate gladly inside an encrypted
channel.
Was this description clear?
Kind regards,
Gyu
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
</body>
</html>