FireBrick Road Warrior Certificates: Difference between revisions

FireBrick Road Warrior Certificates (view source)

Revision as of 13:07, 23 November 2018

477 bytes added , 23 November 2018

m

→‎Let's Encrypt

AA-Andrew

autoreview, Bureaucrats, editor, Interface administrators, reviewer, Administrators

12,270

edits

Revision as of 16:12, 14 March 2017 (view source) Reedy (talk \| contribs) (Fix typo. Remove file renaming to the same) ← Older edit		Revision as of 13:07, 23 November 2018 (view source) AA-Andrew (talk \| contribs) m (→‎Let's Encrypt) Newer edit →
(3 intermediate revisions by 2 users not shown)
<indicator name="RoadW">[[File:Menu-Road-Warrior.svg\|link=:Category:~~FireBrick_IPsec_Road_Warrior~~FireBrick IPsec Road Warrior\|30px\|Back up to the FireBrick Road Warrior Category Page]]</indicator> = Creating Certificates =▼ = Let's Encrypt (easy) = Using FireBrick's built in ACME feature makes installing and maintaining a Let's Encrypt certificate easy. This certificate will be renewed by the FireBrick itself, and can then be used for https access to its web interface and also for ipsec. To configure the FireBrick with Let's Encrypt see [[Enabling HTTPS on the FireBrick]] =Your own CA= The steps below are if you're wanting to create your own CA rather than using Let's Encrypt ▲== Creating Certificates == There are three tools to help with setting up Road Warrior connections on the FireBrick web site. You can download these by viewing with a browser and saving the source, or using curl or wget ege.g.: <SyntaxHighlight lang=bash> #First install an up to date version of bash and openssl #ege.g. via homebrew (once homebrew is installed, <syntaxhighlight lang="bash" inline>brew install openssl</syntaxhighlight> and then <syntaxhighlight lang="bash" inline>brew install bash</syntaxhighlight> #Secondly, modify the make- scripts to use the correct path, iei.e.: <syntaxhighlight lang="bash" inline>#!/usr/local/bin/bash</syntaxhighlight> == Certificate Authority == Then make a certificate file, and sign it using the ''key'' file. We'll call it <tt>ca-cert.pem</tt>. This involves several attributes in the DN (Distinguished name) which mostly don't matter much for your own certificate (/C=Country, /ST=State, /L=Locality, /O=OrganisationName, /CN=CommonName). Typically you would set just the CommonName, using your home or company name (ege.g. /CN=Acme Widget CA). ./make-cert CA DN="/C=GB/O=My Office/CN=example.com" KEY=ca-key.pem ca-cert.pem The private key associated with the CA certificate <tt>ca-key.pem</tt> is no longer needed once it has been used to sign the server certificate. It is a good idea to store this file in a safe place (ege.g. on a memory stick in a secure location), and remove it from any networked machine. It can of course be retrieved and reused if you wish to make further server certificates using the same CA certificate. [[Category:~~FireBrick_IPsec_Road_Warrior~~FireBrick IPsec Road Warrior\|Certificates]]