Network Security Hacks [Electronic resources] نسخه متنی

Hack 46 Distribute Your CA to Clients

Be sure all of your clients trust your new
Certificate Authority.

Once you have created a Certificate
Authority (CA) [Hack #45],
any certificates that are signed by your CA will be trusted by any
program that trusts your CA. To establish this trust, you need to
distribute your CA's certificate to each program
that needs to trust it. This could include email programs, IPSec
installations, or web browsers.

Since SSL uses public key cryptography, there is no need to keep the
certificate a secret. You can simply install it on a web server and
download it to your clients over plain old HTTP. While the instructions for installing a CA
cert are different for every program, this hack will show you a quick
and easy way to install your CA on web browsers.

There are two possible formats that
browsers will accept for new CA
certs: pem and der. You can
generate a der from your existing
pem with a single openssl
command:

$ openssl x509 -in demoCA/cacert.pem -outform DER -out cacert.der

Also, add the following line to the
conf/mime.types file in your Apache
installation:

application/x-x509-ca-cert      der pem crt

Now restart Apache for the change to take effect. You should now be
able to place both the cacert.der and
demoCA/cacert.pem files anywhere on your web
server and have clients install the new cert by simply clicking on
either link.

Early versions of Netscape expected pem format,
but recent versions will accept either. Internet Explorer is just the
opposite (early IE would accept only der format,
but recent versions will take both). Other browsers will generally
accept either format.

You will get a dialog box in your browser when downloading the new
Certificate Authority, asking if you'd like to
continue. Accept the certificate, and that's all
there is to it. Now SSL certs that are signed by your CA will be
accepted without warning the user.

Keep in mind that Certificate Authorities aren't to
be taken lightly. If you accept a new CA in your browser, you had
better trust it completelya mischievous CA manager could sign
all sorts of certs that you should never trust, but your browser
would never complain (since you claimed to trust the CA when you
imported it). Be very careful about who you extend your trust to when
using SSL-enabled browsers. It's worth looking
around in the CA cache that ships with your browser to see exactly
who you trust by default.

For example, did you know that AOL/Time Warner has its own CA? How
about GTE? Or VISA? CA certs for all of these entities (and many
others) ship with Netscape 7.0 for Linux, and are all trusted
authorities for web sites, email, and application add-ons by default.
Keep this in mind when browsing to SSL-enabled sites: if any of the
default authorities have signed online content, your browser will
trust it without requiring operator acknowledgment.

If you value your browser's security (and, by
extension, the security of your client machine), then make it a point
to review your trusted CA relationships.

Rob Flickenger (Linux Server Hacks)