Stunnel/Certificates - Revision history

Admin: /* Testing installed certificate authority on Mac */

2017-04-30T10:26:32Z

Testing installed certificate authority on Mac

← Older revision		Revision as of 10:26, 30 April 2017
Line 125:		Line 125:
	error 20 at 0 depth lookup:unable to get local issuer certificate		error 20 at 0 depth lookup:unable to get local issuer certificate
	</pre>		</pre>

			from manpage of verify(1ssl):

			<pre>
			2 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: unable to get issuer certificate
			the issuer certificate of a looked up certificate could not be found. This normally means the list of trusted certificates is not complete.
			</pre>

			Am giving up on verification step on Mac.

	===Installing certificate authority on linux===		===Installing certificate authority on linux===

Admin: /* Installing certificate authority on mac */

2017-04-30T10:18:28Z

Installing certificate authority on mac

← Older revision		Revision as of 10:18, 30 April 2017
Line 69:		Line 69:
	<pre>		<pre>
	openssl x509 -noout -fingerprint -in ca-certificate-file		openssl x509 -noout -fingerprint -in ca-certificate-file
			</pre>

			Example:

			<pre>
			$ openssl x509 -noout -fingerprint -in stunnel.fullchain.pem
			SHA1 Fingerprint=A9:BB:D8:A7:0C:3D:C0:99:4B:A6:FF:84:29:4C:4E:D2:B7:61:46:2D
	</pre>		</pre>

Admin: /* Testing installed certificate authority on Mac */

2017-04-30T10:16:51Z

Testing installed certificate authority on Mac

← Older revision		Revision as of 10:16, 30 April 2017
Line 106:		Line 106:

	===Testing installed certificate authority on Mac===		===Testing installed certificate authority on Mac===

			<pre>
			$ openssl verify -CApath /System/Library/OpenSSL/certs stunnel.fullchain.pem
			</pre>

			where stnnel.fullchain.pem is the certificate signed by the SSL certificate just added to the Keychain Access app. I had issues:

			<pre>
			$ openssl verify -CApath /System/Library/OpenSSL/certs stunnel.fullchain.pem
			stunnel.fullchain.pem: /CN=reidmachine.party
			error 20 at 0 depth lookup:unable to get local issuer certificate
			</pre>

	===Installing certificate authority on linux===		===Installing certificate authority on linux===

Admin: /* Installing certificate authority on mac */

2017-04-30T10:11:32Z

Installing certificate authority on mac

← Older revision		Revision as of 10:11, 30 April 2017
Line 104:		Line 104:

	Pick "Trust Always" when importing.		Pick "Trust Always" when importing.

			===Testing installed certificate authority on Mac===

	===Installing certificate authority on linux===		===Installing certificate authority on linux===

Admin: /* Testing installed certificate authority on Linux */

2017-04-30T10:11:01Z

Testing installed certificate authority on Linux

← Older revision		Revision as of 10:11, 30 April 2017
Line 126:		Line 126:

	<pre>		<pre>
	$ openssl verify -CApath /~~path~~/to/certs server-certificate-file		$ openssl verify -CApath /etc/ssl/certs server-certificate-file
	</pre>		</pre>

Admin: /* Testing installed certificate authority */

2017-04-30T10:10:43Z

Testing installed certificate authority

← Older revision		Revision as of 10:10, 30 April 2017
Line 121:		Line 121:
	</pre>		</pre>

	===Testing installed certificate authority===		===Testing installed certificate authority on Linux===

	Now test the certificate authority by checking a certificate that has been signed by the CA:		Now test the certificate authority by checking a certificate that has been signed by the CA:

	<pre>		<pre>
	$ openssl verify -CApath /~~System~~/~~Library/OpenSSL~~/certs server-certificate-file		$ openssl verify -CApath /path/to/certs server-certificate-file
	</pre>		</pre>


	=Refs=		=Refs=

Admin: /* Installing certificate authority on mac */

2017-04-30T10:05:55Z

Installing certificate authority on mac

← Older revision		Revision as of 10:05, 30 April 2017
Line 73:		Line 73:
	If they match, you are ready to install it. Open Keychain Acces.app to add the certificate to the Mac keychain.		If they match, you are ready to install it. Open Keychain Acces.app to add the certificate to the Mac keychain.

	The CA file needs to be in PKCS12 format (~~a really stupid~~ decision~~, thanks~~ apple engineers). Turn an X509 .der or .pem format into PKCS12 format using this command:		The CA file needs to be in PKCS12 format (yet another annoying decision to do weird non-standard things by apple engineers). Turn an X509 .der or .pem format into PKCS12 format using this command:

	<pre>		<pre>
Line 89:		Line 89:
	<pre>		<pre>
	$ openssl pkcs12 -export -in pem-certificate-file -nokeys -nodes -out cert.p12		$ openssl pkcs12 -export -in pem-certificate-file -nokeys -nodes -out cert.p12
	</~~rpe~~>		</pre>

	Example:		Example:
Line 103:		Line 103:
	Now open Keychain Access.app. On the left side, pick System. Then pick File > Import Items. Import the.p12 file. You should see new entries that include the name of the certificate authority that signed the certificate.		Now open Keychain Access.app. On the left side, pick System. Then pick File > Import Items. Import the.p12 file. You should see new entries that include the name of the certificate authority that signed the certificate.

	Pick "Trust Always" when importing.		Pick "Trust Always" when importing.

	===Installing certificate authority on linux===		===Installing certificate authority on linux===

Admin: /* Refs */

2017-04-30T09:58:21Z

Refs

← Older revision		Revision as of 09:58, 30 April 2017
Line 142:		Line 142:
	http://bencane.com/2014/02/18/sending-redis-traffic-through-an-ssl-tunnel-with-stunnel/		http://bencane.com/2014/02/18/sending-redis-traffic-through-an-ssl-tunnel-with-stunnel/

			https://security.stackexchange.com/questions/112665/sharing-private-key-stunnel?rq=1


	{{StunnelFlag}}		{{StunnelFlag}}

Admin: /* Installing Certificate Authority */

2017-04-30T09:58:10Z

Installing Certificate Authority

@@ Line 63: / Line 63: @@
 * If you are installing the certificate on Linux, you will need the .pem CA file, which you will put into a file named with the certificate's own hash
 ===Installing certificate authority on linux===
@@ Line 79: / Line 120: @@
 $ ln -s my_ca.pem `openssl x509 -hash -noout -in my_ca.pem`.0
 </pre>
 {{StunnelFlag}}

Admin: /* Verification of Certificates */

2017-04-30T09:33:02Z

Verification of Certificates

@@ Line 32: / Line 32: @@
 * Verify certificates against pre-installed, "pre-trusted" root certificates (e.g., Verisign)
-=Verification of Certificates=
+=Verification=
 By default, stunnel does not verify SSL certificates, so clients will accept whatever SSL certificate they get from the server (or an attacker pretending to be the server).
@@ Line 53: / Line 53: @@
      verify = 3
          Require and verify certificates against locally installed certificates.
 </pre>