lost and found ( for me ? ): Apache

Here are logs when configuring openssl and apache for SSL client certificates.

Reference http://theheat.dk/blog/?p=1023

I have prepared two machines, one is for CA and Apache, the other is for a client.

# tail -1 /etc/lsb-release ;uname -ri

DISTRIB_DESCRIPTION="Ubuntu 12.04.4 LTS"

3.2.0-58-generic x86_64

# apt-get install openssl

create a directory for CA and configure CA

# mkdir –p /home/hattori/SSL_works/u01/app/myCA/certs

# mkdir /home/hattori/SSL_works/u01/app/myCA/csr

# mkdir /home/hattori/SSL_works/u01/app/myCA/newcerts

# mkdir /home/hattori/SSL_works/u01/app/myCA/private

# cp /etc/ssl/openssl.cnf /home/hattori/SSL_works/u01/app/myCA/

# cd /home/hattori/SSL_works/u01/app/myCA/

# ls

certs csr newcerts openssl.cnf private

# echo 00 > serial

# echo 00 > crlnumber

# touch index.txt

# ls

certs crlnumber csr index.txt newcerts openssl.cnf private serial

edit openssl.cnf

dir = /home/hattori/SSL_works/u01/app/myCA

[ CA ]

# openssl genrsa -des3 -passout pass:hello -out private/rootCA.key 2048

# openssl rsa -passin pass:hello -in private/rootCA.key -out private/rootCA.key

# openssl req -config openssl.cnf -new -x509 -subj '/C=JP/L=Tokyo/O=self CA/CN=root.jp' -days 999 -key private/rootCA.key -out certs/rootCA.crt

CA private key

# ls private/

rootCA.key

CA self signed certificate

# ls certs/rootCA.crt

certs/rootCA.crt

[ SSL server certificate ]

# openssl genrsa -des3 -passout pass:qwerty -out private/winterfell.key 2048

# openssl rsa -passin pass:qwerty -in private/winterfell.key -out private/winterfell.key

# openssl req -config openssl.cnf -new -subj '/C=JP/L=Tokyo/O=self/CN=winterfell

' -key private/winterfell.key -out csr/winterfell.csr

# openssl ca -batch -config openssl.cnf -days 999 -in csr/winterfell.csr -out certs/winterfell.crt -keyfile private/rootCA.key -cert certs/rootCA.crt -policy policy_anything

Using configuration from openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

Serial Number: 0 (0x0)

Validity

Not Before: Mar 11 04:53:17 2014 GMT

Not After : Dec 4 04:53:17 2016 GMT

Subject:

countryName = JP

localityName = Tokyo

organizationName = self

commonName = winterfell

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

8C:4E:68:16:C0:A0:CF:D9:EB:18:C5:20:A6:BD:35:F8:A7:3D:36:7B

X509v3 Authority Key Identifier:

keyid:13:EC:F9:4E:BD:AF:1C:1F:49:C4:8A:B3:07:4F:C1:D9:2B:33:CE:36

Certificate is to be certified until Dec 4 04:53:17 2016 GMT (999 days)

Write out database with 1 new entries

Data Base Updated

[ SSL Client Certificate ]

# openssl genrsa -des3 -passout pass:qwerty -out private/client.key 2048

Generating RSA private key, 2048 bit long modulus

..........................................+++

.........................+++

e is 65537 (0x10001)

# openssl rsa -passin pass:qwerty -in private/client.key -out private/client.key

writing RSA key

# openssl req -config openssl.cnf -new -subj '/C=JP/L=Tokyo/O=self/CN=theClient'

-key private/client.key -out csr/client.csr

# openssl ca -batch -config openssl.cnf -days 999 -in csr/client.csr -out certs/client.crt -keyfile private/rootCA.key -cert certs/rootCA.crt -policy policy_anything

Using configuration from openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

Serial Number: 1 (0x1)

Validity

Not Before: Mar 11 04:55:01 2014 GMT

Not After : Dec 4 04:55:01 2016 GMT

Subject:

countryName = JP

localityName = Tokyo

organizationName = self

commonName = theClient

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

2D:CF:85:7A:C0:5C:8A:59:53:F0:EA:9B:2F:FA:86:3D:13:D6:3A:35

X509v3 Authority Key Identifier:

keyid:13:EC:F9:4E:BD:AF:1C:1F:49:C4:8A:B3:07:4F:C1:D9:2B:33:CE:36

Certificate is to be certified until Dec 4 04:55:01 2016 GMT (999 days)

Write out database with 1 new entries

Data Base Updated

[ export the client cert by pkcs12 format ]

# openssl pkcs12 -export -passout pass:qwerty -in certs/client.crt -inkey private/client.key -certfile certs/rootCA.crt -out certs/clientcert.p12

[ Apache]

install apache

# apt-get install apache2

# a2enmod ssl

# a2ensite default-ssl

edit /etc/apache2/sites-available

# grep -v '#' default-ssl | grep -v ^$

ServerAdmin webmaster@localhost

DocumentRoot /var/www

Options FollowSymLinks

AllowOverride None

</Directory>

Options Indexes FollowSymLinks MultiViews

AllowOverride None

Order allow,deny

allow from all

</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

AllowOverride None

Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch

Order allow,deny

Allow from all

</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

LogLevel warn

CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

Alias /doc/ "/usr/share/doc/"

Options Indexes MultiViews FollowSymLinks

AllowOverride None

Order deny,allow

Deny from all

Allow from 127.0.0.0/255.0.0.0 ::1/128

</Directory>

SSLEngine on

SSLCertificateFile /home/hattori/SSL_works/u01/app/myCA/certs/winterfell.crt

SSLCertificateKeyFile /home/hattori/SSL_works/u01/app/myCA/private/winterfell.key

SSLCertificateChainFile /home/hattori/SSL_works/u01/app/myCA/certs/rootCA.crt

SSLCACertificateFile /home/hattori/SSL_works/u01/app/myCA/certs/rootCA.crt

SSLVerifyClient require

SSLVerifyDepth 10

SSLOptions +StdEnvVars

</FilesMatch>

SSLOptions +StdEnvVars

</Directory>

BrowserMatch "MSIE [2-6]" \

nokeepalive ssl-unclean-shutdown \

downgrade-1.0 force-response-1.0

BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

</VirtualHost>

</IfModule>

edit /etc/apache2/sites-available/default file

ServerName winterfell

# /etc/init.d/apache2 restart

[ copy rootCA.crt and clientcert.p12 to the client ]

# scp certs/clientcert.p12 hattori@192.168.0.100:

# scp certs/rootCA.crt hattori@192.168.0.100:

import rootCA.crt and clientcert.p12 on the browser

access to the apache.

small tips.

# tail -1 /etc/lsb-release ;uname -ri

DISTRIB_DESCRIPTION="Ubuntu 12.04.4 LTS"

3.2.0-58-virtual x86_64

install apache2

# apt-get install apache2

edit /etc/apache2/mods-available/mime.conf to allow us to execute cgi, pl, rb, py scripts.

AddHandler cgi-script .cgi .pl .rb .py

# less /etc/apache2/sites-available/default

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

AllowOverride None

Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch

Order allow,deny

Allow from all

</Directory>

start httpd

# apachectl restart

create a python script for the testing and copy it to /usr/lib/cgi-bin directory.

also change permission of python file.

# cat example1.py

#!/usr/bin/env python

print "Content-type: text/html"

print "<html>"

print "<center>Hello, Linux.com!</center>"

print "</html>"

# cp example1.py /usr/lib/cgi-bin/

# chmod 755 /usr/lib/cgi-bin/example1.py

access to http:// IP /cgi-bin/example1.py

[ FORM ]

Reference

http://hp.vector.co.jp/authors/VA003670/python/CGI/QueryStr.htm

html file ( form )

# cat /var/www/example2.html

<html>

<head>

<title>Python CGI Test(1)</title>

</head>

<body>

<h1>Python CGI Test(1)</h1><hr><p>

name: <input type="text" size=30 name="name"><p>

addr: <input type="text" size=30 name="addr"><p>

</form>

</body>

</html>

python script

# cat /var/www/cgi-bin/example2.py

#!/usr/bin/env python

# CGI Test

import cgi

print "Content-Type: text/html\n\n"

print "<html><body>"

form = cgi.FieldStorage()

form_ok = 0

if form.has_key("name") and form.has_key("addr") :

form_ok = 1

if form_ok == 0 :

print "<h1>ERROR</h1>"

else :

print "<h2>Result</h2><hr><p>"

print "<p><b>name: </b>", form["name"].value

print "<p><b>addr: </b>", form["addr"].value

print "</body></html>"

copy the script to /vaw/www/cgi-bin directory.

# mkdir /var/www/cgi-bin <- create a directory if there is not

# cp example2.py /var/www/cgi-bin/

# chmod 755 /var/www/cgi-bin/example2.py

access to http:// IP /example2.html

enter “submit”

lost and found ( for me ? )

lost and found ( for me ? )

Ubuntu12.04 apache: SSL Client certificates

Apache CGI, python script