Changes between Initial Version and Version 1 of SecurityInfo


Ignore:
Timestamp:
11/08/10 22:01:41 (6 years ago)
Author:
chris
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • SecurityInfo

    v1 v1  
     1There is [https://wiki.transitionnetwork.org/Security a page for users on the main wiki], following is some more techie info. 
     2 
     3== Check the SSL cert on the command line == 
     4 
     5The following is based on [http://www.cyberciti.biz/faq/test-ssl-certificates-diagnosis-ssl-certificate/ instructions from nixCraft]. 
     6 
     7Create directory to store certificate: 
     8 
     9{{{ 
     10$ mkdir -p ~/.cert/www.transitionnetwork.org/ 
     11$ cd ~/.cert/www.transitionnetwork.org/ 
     12}}} 
     13 
     14Retrieve the www.transitionnetwork.org certificate provided by the Transition Network web server: 
     15 
     16{{{ 
     17$ openssl s_client -showcerts -connect www.transitionnetwork.org:443 
     18}}} 
     19 
     20Sample output: 
     21 
     22{{{ 
     23CONNECTED(00000003) 
     24depth=0 /OU=Domain Control Validated/OU=Gandi Standard Wildcard SSL/CN=*.transitionnetwork.org 
     25verify error:num=20:unable to get local issuer certificate 
     26verify return:1 
     27depth=0 /OU=Domain Control Validated/OU=Gandi Standard Wildcard SSL/CN=*.transitionnetwork.org 
     28verify error:num=27:certificate not trusted 
     29verify return:1 
     30depth=0 /OU=Domain Control Validated/OU=Gandi Standard Wildcard SSL/CN=*.transitionnetwork.org 
     31verify error:num=21:unable to verify the first certificate 
     32verify return:1 
     33--- 
     34Certificate chain 
     35 0 s:/OU=Domain Control Validated/OU=Gandi Standard Wildcard SSL/CN=*.transitionnetwork.org 
     36   i:/C=FR/O=GANDI SAS/CN=Gandi Standard SSL CA 
     37-----BEGIN CERTIFICATE----- 
     38MIIE9zCCA9+gAwIBAgIRALwjak7zR7NnERA/olIDh34wDQYJKoZIhvcNAQEFBQAw 
     39QTELMAkGA1UEBhMCRlIxEjAQBgNVBAoTCUdBTkRJIFNBUzEeMBwGA1UEAxMVR2Fu 
     40ZGkgU3RhbmRhcmQgU1NMIENBMB4XDTEwMDIxMDAwMDAwMFoXDTExMDIxMDIzNTk1 
     41OVowazEhMB8GA1UECxMYRG9tYWluIENvbnRyb2wgVmFsaWRhdGVkMSQwIgYDVQQL 
     42ExtHYW5kaSBTdGFuZGFyZCBXaWxkY2FyZCBTU0wxIDAeBgNVBAMUFyoudHJhbnNp 
     43dGlvbm5ldHdvcmsub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA 
     44s2ncTx3xMZdby9RhGMrGC3KN9Yr4NiyWYumj/9OROyaTpbsTRGy0N46cis1uY03p 
     4584aWNns6o0TYIqn4XOXco+DWeGjMzMHQ19YKQ2cZ0k+YtjRPT9ss8lXjTJaLK1np 
     46mbp5LaWgZLB+pUFzK9JZJOMCx6B6hJKUDOb3Fgakqujm74aT+bc3iAK7EKvZwUbq 
     47E22Q1Yiae6g3Zd9gQ+yBI7MNg5Kygm8SE3LZ9dntnC+CzgO7t5GvAhnJdfVoHLuC 
     486IDtUlCx1Z7wmDl4tm7qcSaUdd4DGFocIqSpSRayqtAFNH9WnpwMxBROwyChsmFj 
     49FRdHg7D6OYdS9NnpTx/LfwIDAQABo4IBvjCCAbowHwYDVR0jBBgwFoAUtqj/oqgv 
     500KbNS7Fo8+dQEDGneSEwHQYDVR0OBBYEFJM3Cz6AmNOWJySAjBgOd9a4nF36MA4G 
     51A1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMB 
     52BggrBgEFBQcDAjBWBgNVHSAETzBNMEsGCysGAQQBsjEBAgIaMDwwOgYIKwYBBQUH 
     53AgEWLmh0dHA6Ly93d3cuZ2FuZGkubmV0L2NvbnRyYWN0cy9mci9zc2wvY3BzL3Bk 
     54Zi8wPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5nYW5kaS5uZXQvR2FuZGlT 
     55dGFuZGFyZFNTTENBLmNybDBqBggrBgEFBQcBAQReMFwwNwYIKwYBBQUHMAKGK2h0 
     56dHA6Ly9jcnQuZ2FuZGkubmV0L0dhbmRpU3RhbmRhcmRTU0xDQS5jcnQwIQYIKwYB 
     57BQUHMAGGFWh0dHA6Ly9vY3NwLmdhbmRpLm5ldDA5BgNVHREEMjAwghcqLnRyYW5z 
     58aXRpb25uZXR3b3JrLm9yZ4IVdHJhbnNpdGlvbm5ldHdvcmsub3JnMA0GCSqGSIb3 
     59DQEBBQUAA4IBAQCtxu5tBJAnP7xOL5QkUAFyKoSkbHV1i7kc3MqH5h/gbW16lJQa 
     60ke+Ac5M6/AHGc2vK+lKJWvQlVUqynECFjlvfTdD/WQFDcZYEkXrs85aB0ilSHHpr 
     61GCAO8182Y6p2jQSVtkP+cPUH0oOKW1KHBlDkWhU0iy+ooInJu7zy7yvPNxPC3mC+ 
     62TxWmcshBcPLkW1E6NPXrVx1WK9NdYvAn78/kWg2oZxBg/BuDO2UdNhBU824rYvAp 
     63P/Jd/eOoGzT7/JRtbF/xiO5Y10TPT2sjrFLpQodULgnN5TxsE1NcaOqzdDRxaUjb 
     64kUoWZpr6aCIzXPYmtlvmwXVWy+UH8b5A+ZRj 
     65-----END CERTIFICATE----- 
     66--- 
     67Server certificate 
     68subject=/OU=Domain Control Validated/OU=Gandi Standard Wildcard SSL/CN=*.transitionnetwork.org 
     69issuer=/C=FR/O=GANDI SAS/CN=Gandi Standard SSL CA 
     70--- 
     71No client certificate CA names sent 
     72--- 
     73SSL handshake has read 1967 bytes and written 319 bytes 
     74--- 
     75New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA 
     76Server public key is 2048 bit 
     77Secure Renegotiation IS NOT supported 
     78Compression: NONE 
     79Expansion: NONE 
     80SSL-Session: 
     81    Protocol  : TLSv1 
     82    Cipher    : DHE-RSA-AES256-SHA 
     83    Session-ID: D4C55538C4247FF187A1A8C130EA58195580A2996BF8F5343A5512CD8BF38719 
     84    Session-ID-ctx:  
     85    Master-Key: 4C739F03DE2A480D751D7B18A0E7A397B2FD9E8C7763153A91EF6356797BA7653D50D210D22CDB6BC49F787C8399DCBD 
     86    Key-Arg   : None 
     87    Krb5 Principal: None 
     88    Start Time: 1289253341 
     89    Timeout   : 300 (sec) 
     90    Verify return code: 21 (unable to verify the first certificate) 
     91--- 
     92}}} 
     93 
     94Copy from the "-----BEGIN CERTIFICATE-----" to the "-----END CERTIFICATE-----" , and save it in your ~/.cert/www.transitionnetwork.org/ directory as www.transitionnetwork.org.pem. 
     95 
     96This certificate was issued by Gandi, so you need to get "Certification Authority Root Certificate": 
     97 
     98{{{ 
     99$ wget http://crt.gandi.net/GandiStandardSSLCA.crt -O ~/.cert/www.transitionnetwork.org/gandi.pem 
     100}}} 
     101 
     102Create symbolic links to files named by the hash values using c_rehash, enter: 
     103 
     104{{{ 
     105$ c_rehash ~/.cert/www.transitionnetwork.org/ 
     106}}} 
     107 
     108To confirm you have the correct and working certificates, enter: 
     109 
     110{{{ 
     111$ openssl s_client -CApath ~/.cert/www.transitionnetwork.org/ -connect www.transitionnetwork.org:443 
     112}}}