Showing posts with label openssl. Show all posts
Showing posts with label openssl. Show all posts

Wednesday, November 6, 2013

more on certificate administration

bash - how to represent multiple conditions in shell script? - Stack Overflow

http://stackoverflow.com/questions/3826425/how-to-represent-multiple-conditions-in-shell-script

Bash script conditional statements.

OR

if [ $g -eq 1 -a "$c" = "123" ] || [ $g -eq 2 -a "$c" = "456" ]
then echo abc
else echo efg
fi

AND

if [ $g -eq 1 ] && [ "$c" = "123" ]
then echo abc
elif [ $g -eq 2 ] && [ "$c" = "456" ]
then echo abc
else echo efg
fi

Bash Beginner Check Exit Status - Stack Overflow

http://stackoverflow.com/questions/5195607/bash-beginner-check-exit-status

Test in a bash script to see if the last operation had an error. This checks the status code of the last operation.

function test {
    "$@"
    status=$?
    if [ $status -ne 0 ]; then
        echo "error with $1"
    fi
    return $status
}

test command1
test command2

bash script 'for each command line argument'

http://www.linuxquestions.org/questions/linux-newbie-8/bash-script-%27for-each-command-line-argument%27-429058/

Looping over arguments in a bash script call.

    for ARG in "$@"
    do
        echo $ARG
    done

How to slice an array in bash - Stack Overflow

http://stackoverflow.com/questions/1335815/how-to-slice-an-array-in-bash

Slicing an array (like the array of command line arguments) in a bash script.

A=( foo bar "a  b c" 42 )
B=("${A[@]:1:2}")
echo "${B[@]}"    # bar a  b c
echo "${B[1]}"    # a  b c
div[style='display: none;']
ul>li*>a[href=$#]{$#}; li*>a[href=$#]{$#}

Creating Your Own SSL Certificate Authority (and Dumping Self Signed Certs) | The Data Center Overlords

http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/

Signing a csr using a root authority. For testing purposes, this is an easy way to sign a certificate from the comfort of your own workstation.

openssl x509 -req -in device.csr -CA root.pem -CAkey root.key -CAcreateserial -out device.crt -days 500

The Most Common Java Keytool Keystore Commands

http://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html

This is a great resource for many common keytool commands. In particular, I was trying to remember how to delete a key from a keystore.

keytool -delete -alias mydomain -keystore keystore.jks

Cunning: Importing private keys into a Java keystore using keytool

http://cunning.sharp.fm/2008/06/importing_private_keys_into_a.html

Entry description

keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore my-keystore.jks -srckeystore cert-and-key.p12 -srcstoretype PKCS12 -srcstorepass cert-and-key-password -alias 1

The alias of 1 is required to choose the certificate in the source PKCS12 file, keytool isn't clever enough to figure out which certificate you want in a store containing one certificate. - Graham Leggett

http://cunning.sharp.fm/2008/06/importing_private_keys_into_a.html

CTX106630 - How to Use OpenSSL to Create PKCS#12 Certificate Files - Citrix Knowledge Center

http://support.citrix.com/article/CTX106630

Export a PKCS12 keystore from a java keystore. PKCS12 are nice for bundling a certificate chain with your private key and then importing back into your java keystore.

openssl pkcs12 -export -in input.crt -inkey input.key -out bundle.p12

openssl - How can I create a Certificate Service Request (CSR) from and existing public key of a key pair (assume the private key is in a safe spot elsewhere)? - Stack Overflow

http://stackoverflow.com/questions/14617306/how-can-i-create-a-certificate-service-request-csr-from-and-existing-public-ke

Creating a CSR from an existing private key.

openssl req -key my.key -out my.csr

You don't create it ever from a public key. Better yet, if you have a java keystore file that the private key came from, just export a public key from the java keystore instead. It might save a little grief.

keytool -export -alias mydomain -file mydomain.crt -keystore keystore.jks

maven 2 - Can I change the alias of my key? - Stack Overflow

http://stackoverflow.com/questions/3483121/can-i-change-the-alias-of-my-key

Change the alias for an existing entry. There is also code to clone a key, but I didn't need it at the time.

keytool -changealias -alias "your-very-very-long-alias" -destalias "new-alias" -keypass keypass -keystore /path/to/keystore -storepass storepass

Thursday, October 31, 2013

understanding certificate chaining

Help - WebSphere MQ

http://publib.boulder.ibm.com/infocenter/wmqv6/v6r0/index.jsp?topic=%2Fcom.ibm.mq.csqzas.doc%2Fsy10600_.htm

Illustrates a certification path from the certificate owner to the root CA, where the chain of trust begins

Intel(R) AMT SDK Implementation and Reference Guide

http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm?turl=WordDocuments%2Fcertificatechainsforhostbasedconfiguration.htm

Certificate chains may be included with a public key by simply including the rfc blocks in pem format. Their inclusion order is important, though. Consider using cat so that no extra whitespace gets introduced.

-----BEGIN CERTIFICATE-----
Body of the leaf certificate
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
Body of the first intermediate certificate
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
Body of the second intermediate certificate
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
Body of the root certificate
-----END CERTIFICATE-----

OpenSSL - User - check certificate chain in a pem file

http://openssl.6102.n7.nabble.com/check-certificate-chain-in-a-pem-file-td43871.html

It is highly recommended that you convert to and from .pfx files on your own machine using OpenSSL so you can keep the private key there. Use the following OpenSSL commands to convert SSL certificate to different formats on your own machine:

#Convert PEM to P7B
openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cer

#see html reference for more

check certificate chain in a pem file

https://www.sslshopper.com/ssl-converter.html

Concatenate all the previous certificates and the root certificate to one temporary file (This example is for when you are checking the third certifate from the bottom, having already checked cert1.pem and cert2.pem

Thus for the first round through the commands would be

   Unix:     cat root.pem > root-chain.pem
   Windows:  copy /A root.pem root-chain.pem
   Both:     openssl verify -CAfile root-chain.pem cert1.pem

And the second round would be

   Unix:     cat cert1.pem root.pem > cert1-chain.pem
   Windows:  copy /A cert1.pem+root.pem cert1-chain.pem
   Both:     openssl verify -CAfile cert1-chain.pem cert2.pem

Etc.

"keytool -export/import" - Exporting and Importing Certificates

http://www.herongyang.com/JDK/keytool-export-import-Certificates.html
  • The "-export" command option exports the self-signed certificate of my public key into a file, my_home.crt.
  • The "-printcert" command option prints out summary information of a certificate stored in a file in X.509 format. As you can see from the print out, I am the issuer and the owner of this certificate.
  • The "-import" command option imports the certificate from the certificate file back into the keystore under different alias, my_home_crt.

TechStump.com: How to Rearrange a Certificate Chain using OpenSSL

http://www.techstump.com/2012/10/how-to-rearrange-certificate-chain.html

..you do need to know the correct certificate order. The first two are easy, the key should be first and the Server Certificate should be second. Generally the third certificate will be an intermediate and the last will be a root. If you look at each section, you’ll see a -------Begin Certificate------ and -------End Certificate------ section preceded by a header. In the header you’ll see what certificate is what.

keytool-Key and Certificate Management Tool

http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html
-importcert {-alias alias} {-file cert_file} [-keypass keypass] {-noprompt} {-trustcacerts} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg</pre>
 {-v} {-protected} {-Jjavaoption}

Reads the certificate or certificate chain (where the latter is supplied in a PKCS#7 formatted reply or a sequence of X.509 certificates) from the file cert_file, and stores it in the keystore entry identified by alias. If no file is given, the certificate or certificate chain is read from stdin.

.. keytool can import X.509 v1, v2, and v3 certificates, and PKCS#7 formatted certificate chains consisting of certificates of that type. The data to be imported must be provided either in binary encoding format, or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard. In the latter case, the encoding must be bounded at the beginning by a string that starts with "-----BEGIN", and bounded at the end by a string that starts with "-----END".

Option defaults for keytool

-storetype the value of the "keystore.type" property in the security properties file,
           which is returned by the static getDefaultType method in
           java.security.KeyStore

Help - IBM SDK and Runtime Environment Java Technology Edition Version 6

http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/index.jsp?topic=%2Fcom.ibm.java.security.component.doc%2Fsecurity-component%2FkeytoolDocs%2Fsupportedkeystoretypes.html

Supported Key Store Types

  • JKS
  • JCEKS . This keystore implementation employs a much stronger protection of private keys (using password-based encryption with Triple DES) than JKS. You can upgrade your keystore of type "JKS" to type "JCEKS" by changing the password of a private-key entry in your keystore.
  • PKCS12. There is a difference between PKCS12 type keystore created on the keytool provided in the IBM JVM and the keytool provided in an Oracle JVM. The keytool in an IBM JVM uses a PKCS12 keystore to store both key entries and certificate entries.The keytool in an Oracle JVM uses a PKCS12 keystore to store key entries. The keytool program in IBM's JVM can read the keystore created by the keytool program provided by an Oracle JVM, but not the other way around.
  • PKCS12S2. This is a second version of PKCS12 type keystore. It can be read by the keytool program in an Oracle JVM.
  • JCERACFKS. This is a RACF® keyring keystore. This type is available only on z/OS® systems with RACF installed.

OpenSSL: Documents, pkcs7(1)

http://www.openssl.org/docs/apps/pkcs7.html

A different way to package a keystore. Like JKS, only different format.

Creating a PKCS7 (P7B) Using OpenSSL

https://langui.sh/2009/03/20/creating-a-pkcs7-p7b-using-openssl/

This example assumes that you have 2 different certificate files, each in PEM (Base64) format. You can add as many -certfile elements as you want to package in the file. Additionally, concatenated certificate chains are supported.

openssl crl2pkcs7 -nocrl -certfile cert1.cer -certfile cert2.cer -out outfile.p7b

OpenSSL: Documents, verify(1)

http://www.openssl.org/docs/apps/verify.html

The verify command verifies certificate chains.

Tuesday, October 1, 2013

weblog; missing CA Root

X.509 Certificates

The Most Common Java Keytool Keystore Commands

http://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html

Display the contents of a stand-alone certificate. Doesn't show as much details as the openssl command.

Keytool

keytool -printcert -v -file mydomain.crt

OpenSSL

openssl x509 -noout -text -in mydomain.crt

Download Primary PCA Root Certificates | Symantec

http://www.symantec.com/page.jsp?id=roots

Needed to complete CA Root chain for Oracle/PeopleSoft. This seems to do the trick.

wget http://www.verisign.com/repository/roots/root-certificates/PCA-3G3.pem

No trusted certificate found : when opeing a ssl connection from behind the proxy. (Open Source Projects forum at JavaRanch)

http://www.coderanch.com/t/62494/open-source/trusted-certificate-opeing-ssl-connection
  • http://www.coderanch.com/t/62494/open-source/trusted-certificate-opeing-ssl-connection
  • http://stackoverflow.com/questions/10749803/validatorexception-no-trusted-certificate-found-in-java

Two-way ssl handshake

  1. handshake initiated by client; client sends it's identification
  2. server receives, authenticates client and accepts
  3. server sends it's identification
  4. client receives, but fails to authenticate

In our case, it seems the problem is an incomplete CA Root chain.

Monday, July 22, 2013

Work notes; ssl and certificates

SSL; Cipher suites

What are cipher suites?

http://en.wikipedia.org/wiki/Cipher_suite

Configuring Apache to accept a particular list of cipher suites

https://httpd.apache.org/docs/2.0/ssl/ssl_howto.html

Testing ssl connections using OpenSSL's s_client and s_server

http://wiki.wireshark.org/SSL

Bash script to test OpenSSL's supported cipher suites against a given web server

https://www.ssllabs.com/ssltest/index.html

OpenSSL's documentation for ciphers

http://www.openssl.org/docs/apps/ciphers.html#NAME

How to Disable SSL weak Ciphers in Tomcat Server

http://www.fromdev.com/2009/02/tomcat-best-practices-securing-ssl-by.html

How to control the SSL ciphers available to Tomcat

http://stackoverflow.com/questions/7417809/how-to-control-the-ssl-ciphers-available-to-tomcat

Java™ Cryptography Architecture Standard Algorithm Name Documentation; JSSE Cipher Suite Names

http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#jssenames

SSLHandshakeException: Received fatal alert: handshake_failure when setting ciphers on tomcat 7 server

http://stackoverflow.com/questions/15544116/sslhandshakeexception-received-fatal-alert-handshake-failure-when-setting-ciph?rq=1

-keyalg is only one part of the solution; the other peer involved in the ssl conversation must support a compatible hash algorith for OID in addition to supporting a common cipher suite

SSL; handshake

Give me a detailed breakdown of how the ssl-handshake works

http://pic.dhe.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=%2Fcom.ibm.itame2.doc_5.1%2Fss7aumst18.htm

An overview of the SSL handshake

http://publib.boulder.ibm.com/infocenter/wmqv6/v6r0/index.jsp?topic=%2Fcom.ibm.mq.csqzas.doc%2Fsy10660_.htm http://pic.dhe.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=%2Fcom.ibm.itame2.doc_5.1%2Fss7aumst18.htm

SSL; keytool

Documentation for keytool

http://docs.oracle.com/javase/7/docs/technotes/tools/solaris/keytool.html

Keytool and the -keyalg option

http://stackoverflow.com/questions/15544116/sslhandshakeexception-received-fatal-alert-handshake-failure-when-setting-ciph?rq=1

Java keytool; common commands

https://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html

Keytool keeps giving SHA256 sigalg instead of requested alg

http://stackoverflow.com/questions/14163889/keytool-keeps-giving-sha256-sigalg-instead-of-requested-alg

keytool - Key and Certificate Management Tool; Supported Algorithms and Key Sizes

http://docs.oracle.com/javase/1.5.0/docs/tooldocs/solaris/keytool.html

How do I generate a 2048 bit CSR using Java Keytool?

http://www.entrust.net/knowledge-base/technote.cfm?tn=8425

keytool - Key and Certificate Management Tool; Option Defaults

http://docs.oracle.com/javase/7/docs/technotes/tools/solaris/keytool.html

SSL; misc

Online tester for SSL-enabled servers

https://www.ssllabs.com/ssltest/index.html

Hash Algorithm OIDs

http://msdn.microsoft.com/en-us/library/ff635603.aspx

SSL; OpenSSL

Creating a self-signed test certificate

http://www.openssl.org/docs/HOWTO/certificates.txt

Public Key Encryption and Digital Signatures using OpenSSL

http://sandilands.info/sgordon/public-key-encryption-and-digital-signatures-using-openssl

these procedures do not involve browsers at all; it's a great example in raw form of how to use certificates for encrypting and signing data

Testing ssl connections using OpenSSL's s_client and s_server

http://wiki.wireshark.org/SSL

Bash script to test OpenSSL's supported cipher suites against a given web server

https://www.ssllabs.com/ssltest/index.html

OpenSSL's documentation for ciphers

http://www.openssl.org/docs/apps/ciphers.html#NAME

Tomcat

How to Disable SSL weak Ciphers in Tomcat Server

http://www.fromdev.com/2009/02/tomcat-best-practices-securing-ssl-by.html

How to control the SSL ciphers available to Tomcat

http://stackoverflow.com/questions/7417809/how-to-control-the-ssl-ciphers-available-to-tomcat

Tomcat configuration; creating a certificate for an SSL-enabled Tomcat server

http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html

HOWTO: Secure SSL in Tomcat and JBoss

http://www.techstacks.com/howto/secure-ssl-in-tomcat.html

The HTTP Connector; SSL Support - BIO and NIO

http://tomcat.apache.org/tomcat-7.0-doc/config/http.html

Vim

How do you do a case insensitive search using a pattern modifier using less?

http://stackoverflow.com/questions/16828/how-do-you-do-a-case-insensitive-search-using-a-pattern-modifier-using-less

How to do case insensitive search in Vim

http://stackoverflow.com/questions/2287440/how-to-do-case-insensitive-search-in-vim

Bash

Bash custom functions

http://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO-8.html

What's the best way to check that environment variables are set in Unix shellscript

http://stackoverflow.com/questions/307503/whats-the-best-way-to-check-that-environment-variables-are-set-in-unix-shellscr

Weblogic

Using Weblogic SSL

http://www.inf.fu-berlin.de/lehre/WS00/SWT/BEA/documentation/docs51/classdocs/API_secure.html

Introduction to WebLogic Security; Cipher Suites

http://docs.oracle.com/cd/E13222_01/wls/docs81/secintro/concepts.html

Understanding WebLogic Security; J2EE and WebLogic Security

http://docs.oracle.com/cd/E11035_01/wls100/secintro/concepts.html