User Installation of Apache SSL/TLS Certificates on a Unitrends system

SUMMARY

Create, sign and apply certificates on a Unitrends systems' user interface

RESOLUTION

Creating an RSA Key and a Certificate Signing Request

1.   The creation of a new RSA key may or may not be necessary depending on whether the user wishes to generate a new key because they want a new key or they desire a more secure key (i.e. more bits). Since Unitrends shipped with a 1024 bit private key and this key has been proven to be not as secure, this example will start with the creation of a new 2048 bit private key. To create the RSA key, from the command line, via putty, run the following series of commands:  ***If you receive errors related to an unknown option, try typing the command out opposed to copying and pasting*** 
    

   # mkdir /tmp/keys
   # cd /tmp/keys
   # openssl req -newkey rsa:2048 -nodes -keyout <hostname>.key -out <hostname>.csr

    
   This will create a key named <hostname>.key and a certificate signing request named <hostname>.csr in the /tmp/keys directory.                                                                                                                                             
2.   If the existing private key is to be used, one simply generates the certificate signing request (CSR) with the following command:
    

   openssl req -new -sha256 -key /etc/pki/tls/private/localhost.key -out <hostname>.csr

   
   During the generation of the CSR using either Step 1 or 2,  a series of questions will be posed.
   Answer them logically. For example, replacing “MyCountry” with US, GB, FR, DE, etc.
    
   On some questions, the default answer is blank; however, most CA servers will require the hostname of the appliance be accurately entered when that question is presented (though the default answer is blank). If there is no “hostname” available, enter the IP address of the system as the Common Name (CN).
    

   # openssl req -newkey rsa:2048 –sha256 -nodes -keyout <hostname>.key -out <hostname>.csr
   Generating a 2048 bit RSA private key
   .+++
   ......+++
   writing new private key to '<hostname>.key'
   -----
   You are about to be asked to enter information that will be incorporated into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [GB]:MyCountry
   State or Province Name (full name) [Berkshire]:MyState
   Locality Name (eg, city) [Newbury]:MyCity
   Organization Name (eg, company) [My Company Ltd]:MyCompany
   Organizational Unit Name (eg, section) []: MyOrgUnit
   Common Name (eg, your name or your server's hostname) []:<hostname> OR <*.MyDomain.com (if wildcard)>
   Email Address []:
   Please enter the following 'extra' attributes to be sent with your certificate request
   A challenge password []:
   An optional company name []:

    

   Creating a Certificate Signing Request (.csr) containing multiple <hostname> entries

   
   Since many systems may have several hostname and/or IP addresses assigned to various interfaces on different subnets, it is sometimes desirable that the certificate reflect the various names and addresses by which this host is known. The signing request requires the specification of a Version 3 extension (subjectjAltName field) that explicitly names the host names and IP addresses that should be incorporated into the signed certificate.
    
   But first, the V3 request extensions must be enabled in the /etc/pki/tls/openssl.cnf file.
    
3. Edit the  /etc/pki/tls/openssl.cnf and locate the following line:
         

   # req_extensions = v3_req # extensions to add to a certificate request

    
   and remove the leading #. 
    
   Next locate the [ v3_req ] section and add the subjectAltName line.
          

   [ v3_req ]
        
   # Extensions to add to a certificate request
        
   basicConstraints = CA:FALSE
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   subjectAltName = @alt_name
   
   [ alt_name ]
   DNS.1=localhost
   DNS.2=MyHostname1
   DNS.3=MyHostname1.Mydomain.com
   DNS.4=*.Mydomain.com
   IP.1=127.0.0.1
   IP.2=10.10.10.1
   IP.3=x.x.x.x
   

4.   And finally, the openssl req command needs to specify the additional extension section to include via the –reqexts parameter. The tag, “v3_req” matches the [v3_req] section in the openssl.cnf file that was modified in the earlier step to include the subjectAltName parameter.
    

   # openssl req -newkey rsa:2048 –sha256 -nodes -keyout <hostname>.key -out <hostname>.csr  –reqexts v3_req

5.   After answering the questions as explained in the prior section, you may check the data in the certificate request with the following command. If the previous steps were performed correctly, there should be an “X509v3 Subject Alternative Name” section followed by the list of aliases.
    

   # openssl req –text –noout –in <hostname>.csr

   
   The output should look like this:
    

   Certificate Request:
       Data:
           Version: 0 (0x0)
           Subject: C=MyCountry, ST=MyState, L=MyCity, O=MyCompany, OU=MyOrgUnit,
                    CN=<hostname>/emailAddress=me@myemail.com
           Subject Public Key Info:
               Public Key Algorithm: rsaEncryption
                   Public-Key: (2048 bit)
                   Modulus:
                     <2048 bit Key Dump delete>
                   Exponent: 65537 (0x10001)
           Attributes:
           Requested Extensions:
               X509v3 Basic Constraints:
                   CA:FALSE
               X509v3 Key Usage:
                   Digital Signature, Non Repudiation, Key Encipherment
               X509v3 Subject Alternative Name:
                   DNS:hostname1.domain, DNS:hostname2.domain, IP Address:1.1.1.1, IP Address:10.10.10.10
       Signature Algorithm: sha256WithRSAEncryption
           <SHA256 Signature deleted>

Request Certificate from CA Server

6. Run vi <hostname>.csr
7. Highlight the text on the screen, including the Begin Certificate Request and End Certificate Request lines. This will copy the text from the putty window.
8. Open a browser window.
9. Enter https://<CA_host>/certsrv in the address bar where <CA_host> is replaced by the hostname of the certificate server.
10. A Login window should open. Enter an Enterprise Admin account username and password and hit enter.
11. Paste the text of the <hostname>.csr file, including the “BEGIN” and “END” lines into the window.

12.   Switch the certificate template to web server and select Submit.

Download Certificate and Chain File to Appliance

13. Download these files to the PC, placing them in an empty temporary directory.
14. Open a Windows command prompt.
15. Type cd \ and hit enter
16. Type cd program files and hit enter
17. Type cd putty and hit enter
18. Type pscp c:\<tmp folder>\*.* root@<dpu_hostname>:/tmp/keys

19. Respond yes if asked to update cache key
20. Enter DPU root password

21. Return to appliance command line via your putty connection.
22. Type:

cd /tmp/keys

cp *.key /etc/pki/tls/certs/

openssl pkcs7 -print_certs -in <chain_file_name>.p7b -out <chain_file_name>.cer

cp *.cer /etc/pki/tls/certs/ (or cp *.crt /etc/pki/tls/certs/)

cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.orig

23. Edit /etc/httpd/conf.d/ssl.conf

vi /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/pki/tls/certs/<name of new certificate file> (.crt or .cer extension)

SSLCertificateKeyFile /etc/pki/tls/certs/<name of new key file> (.key – generated in Step 1 or 4)

SSLCertificateChainFile /etc/pki/tls/certs/<chain_file_name>  (.cer extension)

24. Hit ESC and type :wq and hit enter to write and quit
25. cd /etc/pki/tls/certs/ and move any localhost.orig and/or localhost.old file to /root.  You should see localhost.crt and localhost.key.  The rest should be moved to /root.
26. Test the changes with the following command:

apachectl configtest (look for a message “Syntax OK”) 

26. Restart the apache daemon using the following command:

apachectl restart