Tag Archives: ssl

Update Service with new SSL certificate

Some service SSL certificate is adminstrate though netsh

start netsh, though a CMD, with just type: netsh

If you then type: http show sslcert, you can see SSL certificate information:

netsh>http show sslcert
SSL Certificate bindings:
-------------------------
IP:port                      : 0.0.0.0:443
Certificate Hash             : 5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5
Application ID               : {4dc3e181-e14b-4a21-b022-59fc669b0914}
Certificate Store Name       : (null)
Verify Client Certificate Revocation : Enabled
Verify Revocation Using Cached Client Certificate Only : Disabled
Usage Check                  : Enabled
Revocation Freshness Time    : 0
URL Retrieval Timeout        : 0
Ctl Identifier               : (null)
Ctl Store Name               : (null)
DS Mapper Usage              : Disabled
Negotiate Client Certificate : Disabled

So to update this ssl certificate you type:

netsh>http add sslcert ipport=0.0.0.0:443 certhash=5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5 appid={4dc3e181-e14b-4a21-b022-59fc669b0914}

Where 5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5 is the thumbprint of the SSL certificate. The thumbprint of a certificate can be found by running this powershell commands:

Get-ChildItem -path cert:\LocalMachine\My

Tomcat Web Server SSL Certificate Installation

How to generate a CSR in Tomcat with Keytool

Create a New Keystore

You will need to create a new Keystore, this is done by this command:

keytool -genkey -alias domainname.prefix -keyalg RSA -keysize 2048 -keystore /path/domainname.prefix.jks

When the commands ask for the firstname and lastname, please type domainname.prefix instead of you name, else the certificate will issues to you name, instead of the domain name.

Generate a CSR from Your New Keystore

  1. Next, you need to generate a CSR file, this is done by this command
    keytool -certreq -alias domainname.prefix -file certreq.cer -keystore /path/domainname.prefix.jks
  2. Type the keystore password that you chose earlier and hit Enter.
  3. Please upload the certreq.cer, to you standard certificate supplier.

Installing the SSL Certificates to the Keystore

  1. You will then get a certificate, save it as signcert.cer
  2. Download aswell the correct intermediate certificate, aswell as the correct root certificate.
  3. Import them with this command:
    keytool -import -trustcacerts -alias root -file root.cer -keystore /path/domainname.prefix.jks
    
    keytool -import -trustcacerts -alias intermediate -file intermediate.cer -keystore /path/domainname.prefix.jks
  1. Import the signed certificate
    keytool -import -trustcacerts -alias domainanme.prefix -file signcert.cer -keystore /path/domainname.prefix.jks

Configuring your SSL Connector

Before Tomcat can accept secure connections, you need to configure an SSL Connector.

  1. In a text editor, open the Tomcat server.xml file.
    The server.xml file is usually located in the conf folder of your Tomcat’s home directory.
  1. Locate the connector that you want to use the new keystore to secure.
    Usually, a connector with port 443 or 8443 is used, as shown in step 4.
  1. If necessary, uncomment the connector.
    To uncomment a connector, remove the comment tags (<!– and –>).
  1. Specify the correct keystore filename and password in your connector configuration.

When you are done, your connector should look something like this:

<Connector port="443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" SSLEnabled="true"clientAuth="false" sslProtocol="TLS" keyAlias="server" keystoreFile="/path/domainname.prefix.jks " keystorePass="your_keystore_password" />

Note: If you are using a version of Tomcat prior to Tomcat 7, you need to change “keystorePass” to “keypass”.

  1. Save your changes to the server.xml file.
  2. Restart Tomcat.

 

Apache and multiple SSL virtual host on same IP address

In standard way, apache only supports one SSL virtual host per IP address, if you want to use different SSL Certificates file. But with mod-gnutls it is possible to have multiple Virtual host with different SSL Certificates file.

Install mod-gnutls in Debian:

apt-get install libapache2-mod-gnutls

Then you need to enable mod-gnutls

cd /etc/apache2/mods-enabled
ln -s ../mods-available/gnutls.* .

Then you need to create the gnutls cache files

touch /var/cache/apache2/gnutls_cache
chmod 700 /var/cache/apache2/gnutls_cache
chown 33.33 /var/cache/apache2/gnutls_cache

And then you need to setup the two virtualhost:

<VirtualHost *:443>
ServerAdmin [email protected]
ServerName v1.dalbjerg.nu
DocumentRoot /var/www/v1.dalbjerg.nu
GnuTLSEnable on
GnuTLSPriorities NORMAL
GnuTLSCertificateFile /etc/apache2/v1/ssl.crt
GnuTLSKeyFile /etc/apache2/v1/ssl.key
</VirtualHost>

<VirtualHost *:443>
ServerAdmin [email protected]
ServerName v2.dalbjerg.nu
DocumentRoot /var/www/v2.dalbjerg.nu
GnuTLSEnable on
GnuTLSPriorities NORMAL
GnuTLSCertificateFile /etc/apache2/v2/ssl.crt
GnuTLSKeyFile /etc/apache2/v2/ssl.key
</VirtualHost>

Then you need to restart apache

apache2cl restart

If it don’t work see at /var/log/apache2/error.log to see any error is reporting there.

[ad]

Importere StartSSL certifikat ind i Internet Explorer

Gå ind på adressen https://startssl.com/certs/ca.cer og vælg ”Forsæt til dette websted (Anbefales ikke)”. (Bemærk det er den røde kryds). Vælg herefter åben. Herefter kommer dette billede frem.

Tryk på Installer certifikat…

Tryk på næste >

Tryk Næste >

Tryk på Udfør

Tryk på Ja

Tryk på OK.

Tryk op OK.

Luk nu din Internet Explorer ned, og start den op igen, nu skulle du gerne slippe for den advarelse med at vores hjemmeside ikke er godkendt.

Apache and Certificate

If you want a sign certificat to use with apache, you need to do this:

openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr

openssl rsa -in server.key -out server.key.insecure
mv server.key server.key.secure
mv server.key.insecure server.key

Mail the server.csr file to certificat trust. Then you get a file back, rename that file to server.crt

Then you need to change this 2 lines, in apache.conf

SSLCertificateFile /etc/httpd/ssl.crt/server.crt
SSLCertificateKeyFile /etc/httpd/ssl.key/server.key

Self-Signed IIS SSL Certificates using OpenSSL

Læs mere her omkring: Self-Signed IIS SSL Certificates using OpenSSL
Self-Signed IIS SSL Certificates using OpenSSL

Self-Signed IIS SSL Certificates using OpenSSL

This tutorial assumes that you have a Linux box with OpenSSL installed,and that you want to create a self-signed certificate for IIS5.0

1. Set up your CA (you only have to do this once)
ON THE LINUX BOX…
* Create a private key

openssl genrsa -des3 -out CA.key 1024

(You’ll need to supply a passphrase. DON’T FORGET THIS!!)

* Set this to read-only for root for security

chmod 400 CA.key

* Create the CA certificate

openssl req -new -key CA.key -x509 -days 1095 -out CA.crt

(Provide appropriate responses to the prompts…for Common Name, you might want to use something like “OurCompany CA”)

* Set the certificate to read-only for root for security

chmod 400 CA.crt

2. Obtain a CSR
ON THE IIS BOX…
* Open the Internet Manager
* Select the site for which you want to create a key
* Right-click and choose Properties
* Select the “Directory Security” tab
* Click the “Server Certificate” button
* Follow the prompts to create a CSR
* Save your CSR, then transfer it to the Linux box for further processing. (For the following steps, we’ll refer to your CSR as “new.csr”)

3. Sign the CSR
ON THE LINUX BOX…
* Sign the CSR (all of this on one line)

openssl x509 -req -days 365 -in new.csr -CA CA.crt
-CAkey CA.key -CAcreateserial -out new.crt

* Transfer the new.crt file back to the IIS box

4. Install self-signed certificate
ON THE IIS BOX…
* Open the Internet Manager
* Select the site to install the key
* Right-click and choose properties
* Select the “Directory Security” tab
* Click the “Server Certificate” button
* Specify that you want to complete the pending request
* Select the .crt file that you just transferred

That’s it!

Qmail: Vpopmail & SSL

Mini howto’s about putting ssl on Vpopmail.
My Qmail is running after this guide:
http://www.pipeline.com.au/staff/mbowe/isp/webmail-server.htm

apt-get install stunnel4
mkdir -p /var/log/qmail/pop3d-ssl/
chown -R qmaill.nofiles /var/log/qmail/pop3d-ssl/

mkdir -p /var/qmail/supervise/qmail-pop3d-ssl
mkdir -p /var/qmail/supervise/qmail-pop3d-ssl/log

/var/qmail/supervise/qmail-pop3-ssl/run

#!/bin/sh
exec /usr/local/bin/softlimit -m 4000000
/usr/local/bin/tcpserver -H -R -v -l annsofie.dumdidum.dk -c100 0 995
/usr/sbin/stunnel4 /var/qmail/control/pop3s.conf 2>&1

/var/qmail/supervise/qmail-pop3d-ssl/log/run

#!/bin/sh
# Keep 30 logs of max 10Mb each
# They will get rotated when they reach 10Mb in size,
# or at midnight when our crontab script fires (whichever event comes 1st)
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n30 /var/log/qmail/pop3d-ssl

/var/qmail/control/pop3s.conf

debug = 1
output = /var/log/qmail/stunnel.log
cert = /var/qmail/control/servercert.pem
exec = /var/qmail/bin/qmail-popup
execargs = /var/qmail/bin/qmail-popup annsofie.dumdidum.dk /home/vpopmail/bin/vchkpw /var/qmail/bin/qmail-pop3d Maildir

cd /var/qmail/control/
openssl req -new -x509 -nodes -out servercert.pem -days 3650 -keyout servercert.pem

ln -s /var/qmail/supervise/qmail-pop3d-ssl/ /service/
svc -u /service//qmail-pop3d-ssl