Re: [gentoo-user] openssl certificates generation under gentoo

[Daniel Iliev]

Buffalo Dickens wrote:
> Many thanks Rumen! Actually I came across many error notifications
> during self certificate generation under Windows 2003 with openssl. As
> this is the gentoo maillist, I will not and should not paste the
> detailed error messages here:)
>
> So I just want to bypass this step under Win, letting linux take this
> task over. I do not know whether there will be some underlying
> conflict in doing this.
>
> Also, I will study what you provide me carefully. Thanks a lot!
>
> --
> You will when you BELIEVE.
> Buffalo Dickens
>
>
>
> 2007/3/29, Rumen Yotov <rumen@××××××.org <mailto:rumen@××××××.org>>:
>
>     On Thu, 29 Mar 2007 15:44:20 +0800
>     "Buffalo Dickens" < zwmaillist@×××××.com
>     <mailto:zwmaillist@×××××.com>> wrote:
>
>     > Hi all! I am not familiar with openssl at all. Here I got a problem.
>     > My Windows 2003 can not (or I can not) accomplish the task of
>     > generating a private key file and a csr file. That holds up my
>     > process of going on with authentication between it and other host
>     > servers.
>     >
>     > I wonder if gentoo linux is able to help finish this step for Win? I
>     > mean, using openssl under gentoo to generate a whole set of private
>     > key and certificate and transferring them to Win host for its use. I
>     > do not know whether that is feasible. Any suggestion will be
>     > appreciated! Thank you!
>     >
>     Hi,
>
>     IMO any linux can do this, you only need openssl (which is BTW also
>     available for Windows, IIRC).
>     Google for the concrete commands (generate a self-signed certificate).
>     Or better try "openca.org <http://openca.org>" to do the work for
>     you ;)
>     HTH. Rumen
>     --
>     gentoo-user@g.o <mailto:gentoo-user@g.o> mailing list
>
>
>

Assuming you want to enable SSL on your Windows Web Server (IIS) you
might try this:

1) Generate Cert. Authority on the Gentoo Box:

openssl genrsa -des3 -out CA.key 1024

(import CA.crt in all the clients in order to make them recognize the CA
and accept the certificates signed by it)

2) Create Cert. Request (Windows Box):
- Open the Internet Manager
- Select the site you want to create a key for
- Right-click >> Properties
- Select "Directory Security"
- Go to "Server Certificate"
- Follow the steps and create a New CSR
- Save your CSR as "new.csr"
- Transfer it to the Gentoo box

3) Sign the CSR on the Gentoo box:

openssl x509 -req -days 365 -in new.csr -CA CA.crt -CAkey CA.key
-CAcreateserial -out new.crt

4) Transfer the signed cert. back to the Windows Box and install it:

- Open the Internet Manager
- Select the site you requested a certif. for
- Right-click >> properties
- Go to "Directory Security" tab
- Choose "Server Certificate"
- Choose that you want to complete the pending request
- Select the .crt file that you transferred from the Gentoo box


HTH

-- 
Best regards,
Daniel


-- 
gentoo-user@g.o mailing list