Changes between Version 1 and Version 2 of APACHE_sharing_iplanet_cert
- Timestamp:
- 12/03/14 15:13:50 (10 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
APACHE_sharing_iplanet_cert
v1 v2 3 3 4 4 == Overview == 5 Handling of certificates is managed different on the legacy systems, E boxes, than that of the IDMP-''x'' cluster. The discussion is divided into two groups, 5 Handling of certificates is managed differently on the legacy systems, E boxes, than that of the IDMP-''x'' cluster. This document focuses only on certificate management for the legacy E Box system. 6 6 7 Apache and iPlanet share the certificate file requested by, and installed under, iPlanet. 7 8 The crt and key file names/locations are indicated in the httpd.conf file: … … 10 11 * SSLCertificateKeyFile: /usr/local/Apache/ssl-certs/<''E Box''>_private.key 11 12 12 == Extracting CRT and Key Components from the iPlanet Certificate ==13 == Extracting CRT and Key Components from the E Box iPlanet Certificate == 13 14 What follows is an example of the process for extracting the crt and key components from the 14 15 iPlanet certificate. The appropriate response to all password prompts is the token value … … 17 18 <''E Box''>:~iplanet/.ssl.pass 18 19 19 The entire listing of passwords used by the user, iplanet on the E Box servers is:IDMP-'xx' servers 20 The IDMP-x cluster servers have set up access based on functionality in a different way. On those machines 21 ''Note:'' the output file name (./junk) in the commands below is arbitrary. 22 Note: the 'pk12util' command below is wrapped with <backslash-newline> on first line. 20 In the example below, the output file name (./junk) in the commands is arbitrary. Also be aware that the ''pk12util'' command below is wrapped with <backslash-newline> on first line. The following options are used: 23 21 22 * '-d /e01/iplanet/servers/alias/' references the location of cert/key database files. 23 * '-P slapd-<E box>-' references the prefix associated with a particular directory. 24 * '-n server-cert' references the nickname of a particular certificate in the cert/key database. 25 26 {{{ 24 27 iplanet@eklutna> /e01/iplanet/servers/shared/bin/pk12util -o ./junk \ 25 -d /e01/iplanet/servers/alias/ -n server-cert -P slapd- eklutna-28 -d /e01/iplanet/servers/alias/ -n server-cert -P slapd-<E box>- 26 29 27 30 Enter Password or Pin for "NSS Certificate DB": *XXYYZZ* … … 29 32 Re-enter password: *XXYYZZ* 30 33 pk12util: PKCS12 EXPORT SUCCESSFUL 34 }}} 31 35 32 ++++++++++++++++++++++++++++++= 33 In the above example: (see also: pkcs12 --help) 36 In additional option may be used: 37 * '[-w p12filepwfile | -W p12filepw]' allows a direct reference to the password file rather than entering it via prompts. 34 38 35 '-d /e01/iplanet/servers/alias/' references the location of cert/key database files. 36 '-P slapd-eklutna-' references the prefix associated with a particular directory. 37 '-n server-cert' references the nickname of a particular certificate in the cert/key database. 39 In the above example: (see also: [[https://www.openssl.org/docs/apps/pkcs12.html|pkcs12 - PKCS#12 file utility - OpenSSL]]) 38 40 39 Each nickname corresponds to a particular cert. The nickname server-cert is the default nickname 40 proposed by iPlanet. That nickname is what we associated with the server name based certs (e.g. 41 the eklutna, elias, egegik and edgar certs are all associated with the server-cert nickname). 42 More recently, certs requested under iPlanet are given more explicit nicknames like 'edirtest'. 41 == Certificate Nicknames == 42 Each nickname referenced by the ''-n'' option corresponds to a particular cert. The nickname, server-cert, is the default nickname proposed by iPlanet. That nickname is what we associated with the server name based certs. In other words, the eklutna, elias, egegik and edgar certs are all associated with the server-cert nickname. More recently, certs requested under iPlanet are given more explicit nicknames like ''dirtiest''. 43 43 44 44 To obtain a list of nicknames from a specific key database: 45 45 {{{ 46 46 iplanet@eklutna> /e01/iplanet/servers/shared/bin/certutil -K -d /e01/iplanet/servers/alias -P slapd-eklutna- 47 47 Enter Password or Pin for "NSS Certificate DB": 48 48 <0> 49 49 <1> server-cert 50 ++++++++++++++++++++++++++++++=51 50 52 51 iplanet@eklutna> ls -al ./junk 53 52 -rw------- 1 iplanet iplanet 2772 Oct 27 16:01 ./junk 54 55 53 iplanet@eklutna> /usr/local/bin/openssl pkcs12 -clcerts -nokeys -in ./junk -out ./eklutna.crt 56 54 Enter Import Password: *XXYYZZ* … … 59 57 iplanet@eklutna> ls -lrt ./eklutna.crt 60 58 -rw-r--r-- 1 iplanet iplanet 1245 Oct 27 16:02 ./eklutna.crt 61 62 59 iplanet@eklutna> /usr/local/bin/openssl pkcs12 -nocerts -in ./junk -out ./eklutna_private.pem 63 60 Enter Import Password: *XXYYZZ* … … 68 65 iplanet@eklutna> ls -lrt ./eklutna_private.pem 69 66 -rw-r--r-- 1 iplanet iplanet 1105 Oct 27 16:05 ./eklutna_private.pem 67 }}} 70 68 71 72 Create key without a pass phrase. 73 69 To create key without a pass phrase. 70 {{ 74 71 iplanet@eklutna> /usr/local/bin/openssl rsa -in ./eklutna_private.pem -out ./eklutna_private.key 75 72 Enter pass phrase for eklutna_private.key: <CR> (null response) … … 78 75 iplanet@eklutna> ls -lrt ./eklutna_private.key 79 76 -rw-r--r-- 1 iplanet iplanet 887 Oct 27 16:06 ./eklutna_private.key 80 77 }}} 81 78 82 79 Now tell 'root' user to move files from "~iplanet" to "/usr/local/Apache/ssl-certs/". 83 80 84 Sample httpd.conf file usage: 81 == HTTPD Configuration == 82 Originally the httpd.conf located at /usr/local/Apache/httpd.conf, included references shown below that corresponded to the certificate file locations listed above: 83 84 /usr/local/Apache/httpd.conf: 85 85 86 86 SSLCertificateFile /usr/local/Apache/ssl-certs/eklutna.crt 87 87 SSLCertificateKeyFile /usr/local/Apache/ssl-certs/eklutna_private.key 88 88 89 The file no longer contains these references. The excerpts contains the current httpd.conf directives. Only those options used (i.e., not all included in the original template) are copied here. 90 91 92 }}} 89 93 ########################################################[[br]] 90 94 LEGACY CHANGE HISTORY - NOTE: All subsequent changes are recorded in TracWiki[[br]]
