FIXME:

Začneme vytvářením klíčů

FIXME:Vytvoříme si klíč pro Win klienta. Takto učiníme ve třech krocích. Prvním je vytvoření žádosti o certifikát wickie.crt.

$ cd ~/firma/mpress/ca
$ openssl req -new -nodes -newkey rsa:1024 -sha1 -keyout wickie.key \
          -out wickie.req
Using configuration from /usr/lib/ssl/openssl.cnf
Generating a 1024 bit RSA private key
.......++++++
.............++++++
writing new private key to 'wickie'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CZ]:
State or Province Name (full name) []:.
Locality Name (eg, city) []:Breclav
Organization Name (eg, company) [Moje Firma, s.r.o.]:FIRMA a.s.
Organizational Unit Name (eg, section) []:IT Departement
Common Name (eg, YOUR name) []:wickie
Email Address []:radek.hnilica@moraviapress.cz

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Vytvořenou žádost o certifikát wickie.req podepíšeme certifikátem autority ca.crt a vytvoříme tak certifikát wickie.crt

$ openssl x509 -req -days 370 -in wickie.req -out wickie.crt \
          -CA ca.crt -CAkey ca.key -CAcreateserial
Signature ok
subject=/C=CZ/L=Breclav/O=FIRMA a.s./OU=IT Departement/CN=wickie/Email=ra\
dek.hnilica@moraviapress.cz
Getting CA Private Key

Pro potřeby MS Windows klienta musíme vytvořit balíček klíčů wickie.p12.

$ openssl pkcs12 -export -in wickie.crt -inkey wickie.key \
          -certfile ca.crt -out wickie.p12
Enter Export Password:
Verifying password - Enter Export Password:
$

Podle uvedénoh vzoru vytvoříme klíče i pro ostatní stanice.

$ openssl req -new -nodes -newkey rsa:1024 -sha1 -keyout jirka.key \
          -out jirka.req
$ openssl x509 -req -days 370 -in jirka.req -out jirka.crt \
          -CA ca.crt -CAkey ca.key -CAcreateserial
Signature ok
subject=/C=CZ/L=Breclav/O=FIRMA a.s./OU=IT Departement/CN=jirka/Email=sp\
rava.site@moraviapress.cz
Getting CA Private Key
$ openssl pkcs12 -export -in jirka.crt -inkey jirka.key \
          -certfile ca.crt -out jirka.p12

$ openssl req -new -nodes -newkey rsa:1024 -sha1 -keyout twada.key -out twada.req
$ openssl x509 -req -days 370 -in twada.req -out twada.crt \
          -CA ca.crt -CAkey ca.key -CAcreateserial
Signature ok
subject=/C=CZ/L=Breclav/O=FIRMA a.s./OU=IT Departement/CN=twada/Email=sprava.site@moraviapress.cz
Getting CA Private Key
$ openssl pkcs12 -export -in twada.crt -inkey twada.key \
          -certfile ca.crt -out twada.p12

Takto vytvořené certifikáty ale ve WinXP nefungují. Měl by fungovat následující postup

Client certificate
openssl req -new -keyout newreq.pem -out newreq.pem -days 730
openssl ca -policy policy_anything -out newcert.pem -extensions xpclient_ext -extfile xpextensions -infiles newreq.pem
openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out cert-clt.p12 -clcerts
openssl pkcs12 -in cert-clt.p12 -out cert-clt.pem
openssl x509 -inform PEM -outform DER -in cert-clt.pem -out cert-clt.der

$ openssl req -new -keyout twada2.pem -out twada.pem -days 370

$ openssl rsa -in passworded-key.pem -out /etc/ipsec.d/private/freeswan-fw.key
$ openssl rsa -in newreq.pem -out twada.key