Testing use cases with OpenSSL

Creating a CA with OpenSSL

  1. Create the ca_certificate_config.cnf OpenSSL configuration file for the certification authority (CA):

    Copy 
    [ req ]
    default_bits       = 4096
    default_keyfile    = ca_private_key.pem
    distinguished_name = req_distinguished_name
    x509_extensions    = req_ext
    prompt             = no

    [ req_distinguished_name ]
    CN = your CA Name
    C  = your country
    L  = your locality
    O  = your organization

    [ req_ext ]
    basicConstraints = critical, CA:true
    keyUsage = critical, digitalSignature, cRLSign, keyCertSign

  2. Generate the RSA private key:

    # openssl genpkey –des3 -algorithm RSA -out ca_private_key.pem \-pkeyopt rsa_keygen_bits:4096

  3. Extract the public key:

    # openssl rsa -in ca_private_key.pem -pubout -out ca_public_key.pem

  4. Generate an autosigned root certificate (10-year validity period):

    # openssl req -x509 -new -key ca_private_key.pem -out ca_certificate.pem -days 3650 \-config ca_certificate_config.cnf

  5. Check the root certificate:

    # openssl x509 -in ca_certificate.pem -text -noout

  6. Move the certificate file (ca_certificate.pem) and the private key (ca_private_key.pem) to the /etc/stormshield/pki directory.

Issuing a mTLS certificate with a CSR

  1. Generate the related mtls_client_csr.cnf CSR configuration file:

    Copy 
    [ req ]
    distinguished_name = req_distinguished_name
    req_extensions     = req_ext
    string_mask        = utf8only
    prompt             = no

    [ req_distinguished_name ]
    C  = your country
    L  = your locality
    O  = your organization
    CN = your common name

    [ req_ext ]
    keyUsage = critical, digitalSignature, keyEncipherment, keyAgreementextendedKeyUsage = serverAuth, clientAuth
    basicConstraints = critical

  2. Generate the CSR private key:

    # openssl genpkey -algorithm RSA -out mtls_client_private_key.pem \ -pkeyopt rsa_keygen_bits:4096

    The certification authority (CA) private keys are extremely sensitive items in terms of security. You must follow the ANSSI recommendations concerning their life cycles.

  3. Generate the CSR:

    # openssl req -new -key mtls_client_private_key.pem \-out mtls_client.csr -config mtls_client_csr.cnf -extensions req_ext

  4. Check the CSR:

    # openssl req -text -noout -in mtls_client.csr

  5. POST the mtls_client.csr content to the URI/{tenantId}/.well-known/est/simpleenroll endpoint with the following headers:

    • Content-Type must be application/pkcs10,

    • Content-Transfer-Encoding must be base64.

     

    The response, Content-Type : application/pkcs7-mime, is a base64 string in PEM style (line breaks every 76 characters), containing the issued certificate in PKCS#7.

  6. If the PKCS#7 content was saved in a mtls_client_certificate.p7 file, extract the issued certificate using these OpenSSL commands:

    # openssl base64 -d -in mtls_client_certificate.p7 | \openssl pkcs7 -inform DER -outform PEM -print_certs \-out mtls_client_certificate.pem

  7. Use both mtls_client_private_key.pem and mtls_client_certificate.pem in the HTTPS agent of your service or with CURL to activate mTLS authentication.