Security Tools

Size: px

Start display at page:

Download "Security Tools"

致米
5 years ago
Views:

2 Certificate Authority ( 認證中心 ) Trusted server which signs certificates One private key and relative public key Tree structure of X.509 Root CA

3 Root CA ( 最高層認證中心 ) Micro$oft 翻譯成根目錄授權憑證通常 Root CA 不會直接用來簽發憑證, 而是授權給一些中間的認證中心, 讓這些中間的認證中心來簽發憑證 Root CA 自己幫自己簽名沒有再上層可以為他簽名認可最高層認證中心經由 secure channel 安裝 Root CA 的憑證 Root CA 只能由一些著名可靠的公司來擔任無法再向上查驗, 所以不可隨便加進系統信任的 Root CA

4 Tree structure of CA 每個合格的 CA, 都會有一個管轄它的最高層 CA 的簽名, 表示 Root CA 授權給它, 可以簽發別人的憑證當程式碰到沒見過的憑證, 憑證上簽名的 CA 也沒見過時, 只要檢查 Root CA 的簽名無誤, 就接受這個憑證 Cost of certificate HiTrust : NT $30,000 / per year / per host Myself : NT $0

5 電子憑證 / 公開金鑰憑證 / 網路身份證 A certificate is issued by a CA X A certificate of a user A consists: The name of the issuer CA X His/her public key KU A The signature Sig(KR X, A, KU A ) by the CA X The expiration date Applications Encryption / Signature

6 Alice: (1) Generate KU A,, KR A (2) Alice, KU A, ID proof (4) Sig(KR X, Alice, KU A, T) CA X: (3) Generate Sig(KR X, Alice, KU A, T) Cert A,X =[Alice, KU A, Sig(KR X, Alice, KU A )] Note: CA does not know KR A

7 Guarantee of CA and certificate Guarantee the public key is of someone Someone is not guaranteed to be safe Security of transmitting DATA Transmit session key first Public crypto system Transmit DATA by session key Symmetric crypto system

Certificate 憑證的原文是 Certificate, 是附上所有人 (owner) 的資料 ( 公司名稱伺服器名稱個人真實姓名連絡 E-mail 通訊地址等資料 ), 後面加上數位簽名的 Public Key 憑證上會附有幾個數位簽名, 代表這些簽名的人, 確認過這個 Public Key 的所有人, 和憑證上所載的資料相符,

8 Certificate 憑證的原文是 Certificate, 是附上所有人 (owner) 的資料 ( 公司名稱伺服器名稱個人真實姓名連絡通訊地址等資料 ), 後面加上數位簽名的 Public Key 憑證上會附有幾個數位簽名, 代表這些簽名的人, 確認過這個 Public Key 的所有人, 和憑證上所載的資料相符, 沒有假造在 X.509 中, 最下層每一個合格的憑證 (Certificate) 上, 會有一個認證中心 (CA) 的簽名, 表示這個認證中心 (CA) 檢查過, 確認憑證上的所有者資料無誤當程式碰到沒見過的憑證時, 只要檢查憑證上認證中心 (CA) 的簽名無誤, 即代表這個認證中心 (CA) 查核過這個憑證 (Certificate), 憑證上的資料無誤

9 Certificate Authority 認證中心的原文是 CA, 是 Certificate Authority 的縮寫, 在微軟繁體中文 WINDOWS 上翻譯成憑證授權認證中心是 X.509 的一環認證中心也是一種憑證, 上面附有認證中心本身的資料, 但不是用來加解密, 而是用來簽發憑證, 證明憑證所有人和憑證上所載的資料無誤每一個合格的認證中心 (CA) 上, 會有一個管轄它的最高層認證中心 (Root CA) 的簽名, 表示最高層認證中心授權給它, 可以簽發別人的憑證當程式碰到沒見過的憑證, 憑證上簽名的認證中心 (CA) 也沒見過時, 只要檢查認證中心上附的最高層認證中心 (Root CA) 的簽名無誤, 即代表這個最高層認證中心 (Root CA), 認為這個認證中心 (CA) 的憑證簽發過程很仔細, 檢查資料很詳實, 所以授權給它, 准許它可以簽發憑證 (Certificate) 所以這個認證中心 (CA) 簽發的憑證 (Certificate), 憑證上的資料也沒有問題 Reference:

10 Flow Generate random seed Generate RootCA Generate private key of RootCA Fill the Request of Certificate. Sign the certificate itself. Generate certificate of Web Server Generate private key of Web Server Fill the Request of certificate Sign the certificate using RootCA Modify apache configuration restart apache

11 Generate random seed openssl rand -out rnd-file num Ex. openssl rand -out /etc/ssl/rootca/private/.rnd 1024 chmod go-rwx rnd-file Ex. chmod go-rwx /etc/ssl/rootca/private/.rnd

12 Generate RootCA Generate private key of RootCA openssl genrsa -des3 -rand rnd-file -out rootca-key-file num % openssl genrsa -des3 -rand /etc/ssl/rootca/private/.rnd \ -out /etc/ssl/rootca/private/rootca.key 2048 Note: phrase are asked (something like password) chmod go-rwx rootca-key-file % chmod go-rwx /etc/ssl/rootca/private/rootca.key

13 Generate RootCA Generate private key of RootCA Fill the Request of Certificate. openssl req -new -key rootca-key-file -out rootca-req-file % openssl req -new -key /etc/ssl/rootca/private/rootca.key \ -out /etc/ssl/rootca/private/rootca.req chmod go-rwx rootca-req-file % chmod go-rwx /etc/ssl/rootca/private/rootca.req Enter pass phrase for rootca-key-file: Country Name (2 letter code) [AU]:TW State or Province Name (full name) [Some-State]:Taiwan Locality Name (eg, city) []:HsinChu Organization Name (eg, company) [Internet Widgits Pty Ltd]:NCTU Organizational Unit Name (eg, section) []:CS Common Name (eg, YOUR name) []:sysadm.cs.nctu.edu.tw Address []:ta@sysadm.nctu.edu.tw A challenge password []: (set if you wan to have a password) An optional company name []: (depends on above setting)

14 Generate RootCA Generate private key of RootCA Fill the Request of Certificate. Sign the certificate itself. openssl x509 -req -days number_of_days -sha1 \ -extfile path_of_openssl.cnf -extensions v3_ca \ -signkey rootca-key-file -in rootca-req-file -out rootca-crtfile % openssl x509 -req -days sha1 -extfile /etc/ssl/openssl.cnf -extensions v3_ca \ -signkey /etc/ssl/rootca/private/rootca.key \ -in /etc/ssl/rootca/private/rootca.req \ -out /etc/ssl/rootca/private/rootca.crt \ rm -f rootca-req-file % rm -f /etc/ssl/rootca/private/rootca.req chmod go-rwx rootca-crt-file % chmod go-rwx /etc/ssl/rootca/private/rootca.crt

15 Generate certificate of Web Server Generate private key of Web Server openssl genrsa -out host-key-file num %openssl genrsa -out /etc/ssl/key/sysadm.key 1024 chmod go-rwx host-key-file %chmod go-rwx /etc/ssl/key/sysadm.key Fill the Request of certificate openssl req -new -key host-key-file -out host-req-file % openssl req -new -key /etc/ssl/key/sysadm.key \ -out /etc/ssl/cert/sysadm.req chmod go-rwx host-req-file % chmod go-rwx /etc/ssl/cert/sysadm.req

16 Generate certificate of Web Server Generate private key of Web Server Fill the Request of certificate Sign the certificate using RootCA Tramsmit host-req-file to Root CA, and do following steps in RootCA openssl x509 -req -days number_of_days -sha1 -extfile path_of_openssl.cnf \ -extensions v3_ca -CA rootca-crt-file -CAkey rootca-key-file \ -CAserial rootca-srl-file -CAcreateserial -in host-req-file -out host-crt-file % openssl x509 -req -days 361 -sha1 -extfile /etc/ssl/openssl.cnf -extensions v3_ca -CA /etc/ssl/rootca/private/rootca.crt \ -CAkey /etc/ssl/rootca/private/rootca.key \ -CAserial /etc/ssl/rootca/private/rootca.srl \ -CAcreateserial \ -in /etc/ssl/cert/sysadm.req \ -out /etc/ssl/cert/sysadm.crt rm -f host-req-file ( in both RootCA and Web Server) % rm -f /etc/ssl/cert/sysadm.req Transmit host-crt-file back to Web Server

17 ## ## SSL Virtual Host Context ## <VirtualHost _default_:443> # General setup for the virtual host DocumentRoot /www/data <Directory "/www/data"> Options Indexes FollowSymLinks AllowOverride All Order allow,deny Allow from all </Directory> ServerName sysadm.cs.nctu.edu.tw:443 ServerAdmin ta@sabsd.cs.nctu.edu.tw ErrorLog /var/log/httpd/sabsd.cs-error.log CustomLog /var/log/httpd/sabsd.cs-access.log common SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:+EXP:+eNULL SSLCertificateFile /etc/ssl/cert/sysadm.crt SSLCertificateKeyFile /etc/ssl/key/sysadm.key

18 Pretty Good Privacy Public key system Encryption Signature security/gnupg Will talk more in Network Administration

PKCS# PEM Erreur! Signet non défini

PKCS# PEM Erreur! Signet non défini TheGreenBow IPSec VPN http://www.thegreenbow.com support@thegreenbow.com TheGreenBow Sistech SA - Sistech 2001-2010 1/27 1... 3 1.1... 3 1.2... 3 2... 4 2.1... 4 2.2 PKCS#12... 6 2.3 PEM... 8 2.4... Erreur!