1. PKI Processing with OpenSSL Rodney Thayer rodney@tillerman.to

2. Rodney Thayer2 Contents Standards Protocols OpenSSL as a Tool OpenSSL as PKI Tool OpenSSL as PKI Subsystem

3. Rodney Thayer3 Introduction Open source OpenSSL (formerly SSLEAY) Processes IETF TLS and SSL 2,3 (Netscape) Processes Public Key certificates (for PKI)

4. Rodney Thayer4 Standards Algorithms: RSA, DSA, MD5, SHA-1 RFC 2459 (PKIX); X.509 DER and PEM PKI Standard features: Roots, CRL’s, OCSP PKCS 7, 1, 10

5. Rodney Thayer5 Protocols TLS and SSL, using certificates SMIME IPsec for VPN’s

6. Rodney Thayer6 OpenSSL as a Tool

7. Rodney Thayer7 ‘openssl’ - the program Apps/ directory commands for tls tests commands for crypto commands for cert processing uses simple keystore uses DER and PEM format certificates

8. Rodney Thayer8 Standard commands asn1parse ca ciphers crl crl2pkcs7 dgst dh dhparam dsa dsaparam enc errstr gendh gendsa genrsa nseq passwd pkcs12 pkcs7 pkcs8 rand req rsa rsautl s_client s_server s_time sess_id smime speed spkac verify version x509

9. Rodney Thayer9 Message Digest commands (see the `dgst' command for more details) md2 md4 md5 mdc2 rmd160 sha sha1

10. Rodney Thayer10 Cipher commands (see the `enc' command for more details) base64 bf bf-cbc bf-cfb bf-ecb bf-ofb cast cast-cbc cast5-cbc cast5-cfb cast5-ecb cast5-ofb des des-cbc des-cfb des-ecb des-ede des-ede-cbc des-ede-cfb des-ede-ofb des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb des-ofb des3 desx idea idea-cbc idea-cfb idea-ecb idea-ofb rc2 rc2-40-cbc rc2-64-cbc rc2-cbc rc2-cfb rc2-ecb rc2-ofb rc4 rc4-40 rc5 rc5-cbc rc5-cfb rc5-ecb rc5-ofb

11. Rodney Thayer11 OpenSSL as a PKI Tool

12. Rodney Thayer12 ‘openssl’ - the program Apps/ directory commands for tls tests commands for crypto commands for cert processing uses simple keystore uses DER and PEM format certificates

13. Rodney Thayer13 ‘openssl’ commands  asn1parse ca crl crl2pkcs7 dsaparam

14. Rodney Thayer14 ‘openssl’ commands ( cont.) Pkcs7 req x509

15. Rodney Thayer15 OpenSSL as a Subsystem Builds to a library API for certificate processing API for underlying crypto operations used by TLS/SSL, ‘openssl’ application

16. Rodney Thayer16 Subsystem Uses TLS and SSL SMIME OpenSSH GPKCS Embedded systems

17. Rodney Thayer17 API Calls for Cert Request See apps/req.c 1. Make key pair 2. Configure certificate request 3. Sign certificate request 4. Output as DER or PEM

18. Rodney Thayer18

19. Rodney Thayer19 Conclusion General purpose cryptographic tool Provides PKI processing Out of the box support for standards Published API Definitely product-grade solution

20. Contact Info Rodney Thayer The Tillerman Group rodney@tillerman.to http://www.pkiclue.com/presentations