Skip to main content

Below is the script I created to manage this certificate creation steps....

# cat DsCreateCert
#!/bin/ksh -a

# If the following flag is set to 1, certutil will be used. If set to 0, openssl will be used
flagUseCertutil=1

# DER: a binary format
# PEM: base-64 encoded DER format with header and footer
# certutil: Default is DER. For PEM, use "-a"
# openssl: Default is PEM. For DER, use "-inform DER" and/or "-outform DER"
flagUseDer=0
flagUsePem=1

openSslPath=/usr/local/ssl
SSL=${openSslPath}/bin/openssl
CERT=/usr/sfw/bin/certutil
PK12=/usr/sfw/bin/pk12util

# Fake CA (Certification Authority) database
caDbPath=/store/bnz/cacertdb
caId="ca-"
caDbId="-d ${caDbPath} -P ${caId}"

# LDAP server certification database
serverRoot="/var/ldap_data_files/ds"
serverDbPrefix="slapd-"
serverDbPath="${serverRoot}/alias"
serverDbId="-d ${serverDbPath} -P ${serverDbPrefix}"

# Certificate
subjectSuffix="ou=BTS,o=Bank of New Zealand,l=Andreas Berendsen,st=NI,c=NZ"
subjectCA="cn=BNZ_CA,${subjectSuffix}"
subjectCert="cn=$(hostname).$(domainname),${subjectSuffix}"

#===============================================================================
#===============================================================================
ShowChapter() {
echo "
********************************************************************************
* ${1}
********************************************************************************
"
}

#===============================================================================
#===============================================================================
ShowStep() {
echo "+------------------------------------------------------------------------"
while [[ "${1}" != "" ]]; do
  echo "| ${1}"
  shift
done
echo "+------------------------------------------------------------------------"
}

#===============================================================================
#===============================================================================
rm -rf /store/bnz/cacertdb
#rm -rf /store/bnz/cacertdb ${serverDbPath}/${serverDbPrefix}*.db

ShowChapter "Checking NSS database password protection"
if [[ $( echo $(dsadm get-flags ${serverRoot} | grep cert-pwd-prompt|cut -d':' -f2) ) = off ]]; then
  ShowStep "Stooping DS"
  dsadm stop ${serverRoot}
  ShowStep "Setting NSS database password" \
           " " \
           "At prompt 'Choose the new certificate database password:', type password" \
           "At prompt 'Confirm the new certificate database password:', type password"
  dsadm set-flags ${serverRoot} cert-pwd-prompt=on
  echo "Internal (Software) Token:password" > ${serverDbPath}/${serverDbPrefix}pin.txt
  chmod 400 ${serverDbPath}/${serverDbPrefix}pin.txt
  ShowStep "Starting DS" \
           " " \
           "At prompt 'Enter PIN fro Internal (Software) Token', type password"
  dsadm start ${serverRoot} 2>/dev/null
fi

ShowChapter "NSS database clean-up"
certutil -L ${serverDbId}|grep -v "defaultCert"|cut -d' ' -f1|while read certName; do
  echo "----- Removing certificate ${certName}"
  certutil -D ${serverDbId} -n ${certName}
done

#-----
#----- Prepare Test Certification Authority (CA) environment
#-----
if [[ ! -e ${caDbPath}/ca-cert8.db ]]; then
  ShowChapter "Creating CA environment and database"
  if [[ ${flagUseCertutil} -eq 0 ]]; then
    #.....................................................................
    # Using OpenSSL to create CA database
    #.....................................................................
    if [[ $( grep -c "${caDbPath}" ${openSslPath}/misc/CA.pl ) -eq 0 ]]; then
      ShowStep "Updating ${openSslPath}/misc/CA.pl"
      [[ -e ${openSslPath}/misc/CA.pl ]] && cp ${openSslPath}/misc/CA.pl ${openSslPath}/misc/CA.pl.backup.$$
      sed -e "/^$CATOP=/s_=.*$_=\"${caDbPath}\";_" ${openSslPath}/misc/CA.pl.backup.$$ > ${openSslPath}/misc/CA.pl
    fi

    if [[ $( grep -c "${caDbPath}" ${openSslPath}/openssl.cnf ) -eq 0 ]]; then
      ShowStep "Updating ${openSslPath}/openssl.cnf"
      [[ -e ${openSslPath}/openssl.cnf ]] && cp ${openSslPath}/openssl.cnf ${openSslPath}/openssl.cnf.backup.$$
      sed "/^dir/s_=.*$_=${caDbPath}_" ${openSslPath}/openssl.cnf.backup.$$ > ${openSslPath}/openssl.cnf
    fi

    ShowStep "Creating CA directory structure at ${caDbPath}" \
             " " \
             "At prompt 'CA certificate filename (or enter to create)' press ENTER" \
             "At prompt 'Enter PEM pass phrase:', type password" \
             "At prompt 'Verifying - Enter PEM pass phrase:' type password"\
             "At subsequente prompts, press ENTER"

    perl ${openSslPath}/misc/CA.pl -newca
  else
    #.....................................................................
    # Using certutil to create CA database
    #.....................................................................
    [[ ! -e ${caDbPath} ]] && mkdir ${caDbPath}
    cd ${caDbPath}

    ShowStep "Create CA certificate DB" \
             " " \
             "At prompt 'Enter new password:' type password" \
             "At prompt 'Re-enter password:' type password"

    ${CERT} -N ${caDbId}

    ShowStep "Create a self-signed CA certificate" \
             " " \
             "At prompt 'Enter Password or Pin for \"NSS Certificate DB\":' type password" \
             "After the key creation is finished, choose option 5 and then 9" \
             "At prompt 'Is this a critical extension [y/N]?', type Y"

    ${CERT} -S ${caDbId} -x -n "ca-cert" -s "${subjectCA}" -t CTPu -v 120 -5

    if [[ ${flagUsePem} -eq 1 ]]; then
      #..................................................export CA in text (PEM)
      ShowStep "Export the CA cert into an output file in PEM format" \
               "" \
               "At prompt 'Enter Password or Pin for \"NSS Certificate DB\":', type password" \
               "At subsequent prompts, simply press ENTER and accept the default values"
      ${CERT} -L ${caDbId} -n "ca-cert" -a > cacert.pem
    fi
    if [[ ${flagUseDer} -eq 1 ]]; then
      #................................................export CA in binary (DER)
      ShowStep "Export the CA cert into an output file in DER format" \
               "" \
               "At prompt 'Enter Password or Pin for \"NSS Certificate DB\":', type password" \
               "At subsequent prompts, simply press ENTER and accept the default values"
      ${CERT} -L ${caDbId} -n "ca-cert" > cacert.der
    fi
  fi
fi


#-----
#----- Create NSS DB for Directory Server
#-----
#       This block needs to be adjusted to use currect directory (DS) server database
ShowChapter "Create NSS DB for Directory Server"
if [[ ! -e ${serverDbPath}/${serverDbPrefix}cert8.db ]]; then
  ${CERT} -N ${serverDbId}
else
  echo "***** Database already craeted. Nothing to do"
fi

#------
#----- Generate Certificate Signing Request (CSR) for server cert
#-----
ShowChapter "Generate Certificate Signing Request (CSR) for server cert"
if [[ ${flagUseCertutil} -eq 1 ]]; then
  ShowStep "At prompt 'Enter Password or Pin for \"NSS Certificate DB\":', type password"
  [[ ${flagUseDer} -eq 1 ]] && ${CERT} -R ${serverDbId} -s "${subjectCert}" -o DER.csr
  [[ ${flagUsePem} -eq 1 ]] && ${CERT} -R ${serverDbId} -s "${subjectCert}" -o PEM.csr -a
else
  ShowStep "Generate 2048-bit RSA private key"
  ${SSL} genrsa -out privkey.pem 2048

  ShowStep "Generate the certificate request" \
           " " \
           "At all prompts, press ENTER to accept the default value"
  ${SSL} req -new -key privkey.pem -out PEM.csr

  ShowStep "Display the content and public key from the certificate request"
  ${SSL} req -in PEM.csr -text -pubkey
fi

#-----
#----- Sign CSR using Fake CA
#-----
ShowChapter "Sign CSR using Fake CA"

if [[ ${flagUseCertutil} -eq 1 ]]; then
  if [[ ${flagUseDer} -eq 1 ]]; then
    ShowStep "Sign DER CSR" \
             "" \
             "After the key creation is finished, choose option 5 and then 9" \
             "At prompt 'Is this a critical extension [y/N]?', type Y" \
             "At prompt 'Enter Password or Pin for \"NSS Certificate DB\":' type password"
    ${CERT} -C ${caDbId} -c "ca-cert" -i DER.csr -o ./cert.der -v 12 -5
  fi

  if [[ ${flagUsePem} -eq 1 ]]; then
    ShowStep "Sign PEM CSR" \
             "" \
             "After the key creation is finished, choose option 5 and then 9" \
             "At prompt 'Is this a critical extension [y/N]?', type Y" \
             "At prompt 'Enter Password or Pin for \"NSS Certificate DB\":' type password"
    ${CERT} -C ${caDbId} -c "ca-cert" -i PEM.csr -o ./cert.pem -v 12 -5 -a
  fi
else
  ShowStep "openssl" \
           "" \
           "At prompt 'Enter pass phrase for /store/bnz/cacertdb/private/cakey.pem:' type password"
  ${SSL} ca -policy policy_anything -cert cacert.pem -in PEM.csr -out ./cert.pem
fi

#-----
#----- Import signed certs into NSS DB
#-----
ShowChapter "Import signed certs into NSS DB"
if [[ ${flagUseCertutil} -eq 1 ]]; then
  if [[ ${flagUsePem} -eq 1 ]]; then
    ShowStep "Import PEM server cert"
    ${CERT} -A ${serverDbId} -n "server-cert" -i cert.pem   -t Pu -a

    ShowStep "mport PEM CA cert"
    ${CERT} -A ${serverDbId} -n "ca-cert"     -i cacert.pem -t CT -a
  fi
  if [[ ${flagUseDer} -eq 1 ]]; then
    ShowStep "Import DER server cert"
    ${CERT} -A ${serverDbId} -n "server-cert" -i cert.der   -t Pu

    ShowStep "mport DER CA cert"
    ${CERT} -A ${serverDbId} -n "ca-cert"     -i cacert.der -t CT
  fi

  ShowStep "List all certificates"
  echo ""|${CERT} -L ${serverDbId}

  ShowStep "List the conetnst of server certificate"
  echo ""|${CERT} -L ${serverDbId} -n "server-cert"

  ShowStep "List the contents of CA certificate"
  echo ""|${CERT} -L ${serverDbId} -n "ca-cert"
else
  ${SSL} pkcs12 -export -in cert.pem -inkey privkey.pem -certfile cacert.pem -name "MY CERTIFICATE" -out mycert.p12
  ${PK12} -i mycert.p12 ${serverDbId} -v
fi

#-----
#----- Enable SSl
#-----
ShowChapter "Enable SSl"
echo "Total ciphers allowed: $( dsconf get-server-prop -D "cn=Directory Manager" -h wgtsinf01 -p 389 -c ssl-supported-ciphers|wc -l)"
dsconf set-server-prop -D "cn=Directory Manager" -h wgtsinf01 -p 389  ssl-cipher-family:TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ssl-cipher-family:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ssl-cipher-family:TLS_DHE_RSA_WITH_AES_256_CBC_SHA ssl-cipher-family:TLS_DHE_DSS_WITH_AES_256_CBC_SHA ssl-cipher-family:TLS_ECDH_RSA_WITH_AES_256_CBC_SHA ssl-cipher-family:TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA ssl-cipher-family:TLS_RSA_WITH_AES_256_CBC_SHA ssl-cipher-family:TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ssl-cipher-family:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ssl-cipher-family:TLS_ECDHE_RSA_WITH_RC4_128_SHA ssl-cipher-family:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ssl-cipher-family:TLS_DHE_DSS_WITH_RC4_128_SHA ssl-cipher-family:TLS_DHE_RSA_WITH_AES_128_CBC_SHA ssl-cipher-family:TLS_DHE_DSS_WITH_AES_128_CBC_SHA ssl-cipher-family:TLS_ECDH_RSA_WITH_RC4_128_SHA ssl-cipher-family:TLS_ECDH_RSA_WITH_AES_128_CBC_SHA ssl-cipher-family:TLS_ECDH_ECDSA_WITH_RC4_128_SHA ssl-cipher-family:TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA ssl-cipher-family:SSL_RSA_WITH_RC4_128_MD5 ssl-cipher-family:SSL_RSA_WITH_RC4_128_SHA ssl-cipher-family:TLS_RSA_WITH_AES_128_CBC_SHA ssl-cipher-family:TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA ssl-cipher-family:TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA ssl-cipher-family:SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA ssl-cipher-family:SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA ssl-cipher-family:TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA ssl-cipher-family:TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA ssl-cipher-family:SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA ssl-cipher-family:SSL_RSA_WITH_3DES_EDE_CBC_SHA ssl-cipher-family:SSL_DHE_RSA_WITH_DES_CBC_SHA ssl-cipher-family:SSL_DHE_DSS_WITH_DES_CBC_SHA ssl-cipher-family:SSL_RSA_FIPS_WITH_DES_CBC_SHA ssl-cipher-family:SSL_RSA_WITH_DES_CBC_SHA ssl-cipher-family:TLS_RSA_EXPORT1024_WITH_RC4_56_SHA ssl-cipher-family:TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA ssl-cipher-family:SSL_RSA_EXPORT_WITH_RC4_40_MD5 ssl-cipher-family:SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 ssl-cipher-family:TLS_ECDHE_ECDSA_WITH_NULL_SHA ssl-cipher-family:TLS_ECDHE_RSA_WITH_NULL_SHA ssl-cipher-family:TLS_ECDH_RSA_WITH_NULL_SHA ssl-cipher-family:TLS_ECDH_ECDSA_WITH_NULL_SHA ssl-cipher-family:SSL_RSA_WITH_NULL_SHA ssl-cipher-family:SSL_RSA_WITH_NULL_MD5 ssl-cipher-family:SSL_CK_RC4_128_WITH_MD5 ssl-cipher-family:SSL_CK_RC2_128_CBC_WITH_MD5 ssl-cipher-family:SSL_CK_DES_192_EDE3_CBC_WITH_MD5 ssl-cipher-family:SSL_CK_DES_64_CBC_WITH_MD5 ssl-cipher-family:SSL_CK_RC4_128_EXPORT40_WITH_MD5 ssl-cipher-family:SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
dsadm restart ${serverRoot} 2>/dev/null

This drawing shows how the computers are connected. This subnet is isolated from other subnets and is used solely for testings.

+---------+  +---------+  +---------+  +---------+
|wgtsinf01|  |wgls01   |  |wgls02   |  |wgls03   |
|Solaris9 |  |Solaris10|  |Solaris9 |  |Solaris8 |
|DSEE6.1  |  |         |  |         |  |         |
+---------+  +---------+  +---------+  +---------+
    |.50         |.11         |.12         |.13
    |            |            |            |
================================================== 10.64.47.x/24 (Test subnet)

Cheers,
Andreas

Comments

Post a Comment

Popular posts from this blog

Movie - Se7en (1995)

  My views Plot In an unnamed city overcome with violent crime and corruption, disillusioned police Detective Lieutenant William Somerset is one week from retirement. He is partnered with David Mills, a young, short-tempered, idealistic detective who recently relocated to the city with his wife, Tracy. On Monday, Somerset and Mills investigate an obese man who was forced to eat until his stomach burst, killing him. The detectives find the word " gluttony " written on a wall. Somerset, considering the case too extreme for his last investigation, asks to be reassigned, but his request is denied. The following day, another victim, who had been forced to cut one pound (0.45 kg) of flesh from his body, is found; the crime scene is marked " greed ." Clues at the scene lead Somerset and Mills to the  sloth  victim, a drug-dealing  pederast  whom they find emaciated and restrained to a bed. Photographs reveal the victim was restrained for precisely one year. Somers...
Post a Comment
Read more

IT - Which Is Faster: find | cpio -pdvm OR rsync?

To determine which is faster between find | cpio -pdvm and rsync for copying a large directory tree locally, we need to consider several factors: the nature of the operation, the tools' design, the system environment, and the specific use case. Let’s break this down based on the information provided in the web results and general knowledge about these tools. Overview of the Tools find | cpio -pdvm : find : Recursively lists all files and directories in a given path. cpio : A tool for copying files into or out of a cpio or tar archive. In this case, with the -pdvm options: -p : Pass-through mode (copy files from one directory tree to another). -d : Create directories as needed. -v : Verbose mod...
Post a Comment
Read more

Movie - The Wizard of Oz (1939)

  My views Plot In rural  Kansas ,  Dorothy Gale  lives on a farm owned by her Uncle Henry and Aunt Em, and wishes she could be somewhere else. Dorothy's neighbor, Almira Gulch, who had been bitten by Dorothy's dog, Toto, obtains a sheriff's order authorizing her to seize Toto. Toto escapes and returns to Dorothy, who runs away to protect him. Professor Marvel, a charlatan fortune-teller, convinces Dorothy that Em is heartbroken, which prompts Dorothy to return home. She returns just as a  tornado  approaches the farm. Unable to get into the locked storm cellar, Dorothy takes cover in the farmhouse and is knocked unconscious. She seemingly awakens to find the house moving through the air, with her and Toto still inside it. The house comes down in an unknown land, and Dorothy is greeted by a good witch named  Glinda , who floats down in a bubble and explains that Dorothy has landed in Munchkinland in the  Land of Oz , and that the Munchkins are cel...
Post a Comment
Read more