1. Onno W. Purbo onno@indo.net.id
openssl
Onno W. Purbo

2. Reference http://www.openssl.org http://www.linuxdoc.org

3. OpenSSL
OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them.

4. OpenSSL
The openssl program is a command line tool for using the various cryptography functions of OpenSSL's crypto library from the shell. It can be used for
Creation of RSA, DH and DSA key parameters
Creation of X.509 certificates, CSRs and CRLs
Calculation of Message Digests
Encryption and Decryption with Ciphers
SSL/TLS Client and Server Tests
Handling of S/MIME signed or encrypted mail

5. Standard Commands Asn1parse - Parse an ASN.1 sequence.
Ca - Certificate Authority (CA) Management.
Ciphers - Cipher Suite Description Determination.
Crl - Certificate Revocation List (CRL) Management.
Crl2pkcs7 - CRL to PKCS#7 Conversion.
Dgst - Message Digest Calculation.
Dh - Diffie-Hellman Parameter Management. Obsoleted by dhparam.
Dsa - DSA Data Management.

6. Standard Commands Dsaparam - DSA Parameter Generation.
Enc - Encoding with Ciphers.
Errstr - Error Number to Error String Conversion.
Dhparam - Generation and Management of Diffie-Hellman Parameters.
Gendh - Generation of Diffie-Hellman Parameters. Obsoleted by dhparam.
Gendsa - Generation of DSA Parameters.
Genrsa - Generation of RSA Parameters.

7. Standard Commands Ocsp - Online Certificate Status Protocol utility.
Passwd - Generation of hashed passwords.
Pkcs7 - PKCS#7 Data Management.
Rand - Generate pseudo-random bytes.
Req - X.509 Certificate Signing Request (CSR) Management.
Rsa - RSA Data Management.
Rsautl - RSA utility for signing, verification, encryption, and decryption.

8. Standard Commands
s_client - This implements a generic SSL/TLS client which can establish a transparent connection to a remote server speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL ssl library.

9. Standard Commands
s_server - This implements a generic SSL/TLS server which accepts connections from remote clients speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL ssl library. It provides both an own command line oriented protocol for testing SSL functions and a simple HTTP response facility to emulate an SSL/TLS-aware webserver.

10. Standard Commands s_time - SSL Connection Timer.
sess_id - SSL Session Data Management.
Smime - S/MIME mail processing.
Speed - Algorithm Speed Measurement.
Verify - X.509 Certificate Verification.
Version - OpenSSL Version Information.
X509 - X.509 Certificate Data Management.

11. /etc/httpd/conf/ [root@linux conf]# ls -l total 68
lrwxrwxrwx 1 root root May 2 04:06 Makefile -> ../../../usr/share/ssl/certs/Makefile
-rw-r--r root root Aug access.conf
-rw-r--r root root Aug httpd.conf
-rw-r--r root root Aug srm.conf
drwx root root May 2 04:06 ssl.crl
drwx root root May 2 04:06 ssl.crt
drwx root root May 2 09:43 ssl.csr
drwx root root May 2 04:06 ssl.key
drwx root root May 2 04:06 ssl.prm

12. make usage [root@linux conf]# make usage
This makefile allows you to create:
o public/private key pairs
o SSL certificate signing requests (CSRs)
o self-signed SSL test certificates
To create a key pair, run "make SOMETHING.key".
To create a CSR, run "make SOMETHING.csr".
To create a test certificate, run "make SOMETHING.crt".
To create a key and a test certificate in one file, run "make SOMETHING.pem".
To create a key for use with Apache, run "make genkey".
To create a CSR for use with Apache, run "make certreq".
To create a test certificate for use with Apache, run "make testcert".

13. Private Key

14. make server.key [root@linux conf]# make server.key umask 77 ; \
/usr/bin/openssl genrsa -des3 -rand 1024 > server.key
0 semi-random bytes loaded
Generating RSA private key, 512 bit long modulus
e is (0x10001)
Enter PEM pass phrase:
Verifying password - Enter PEM pass phrase:

15. More server.key [root@linux conf]# more server.key
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,317BF4C50E1C590B
X/V5VDJxPg702miehbOCsumLf2QS9vpO2YxI9BLsNrtBkPyN363UEVQ9Hsrpct
mQhDa+/BXuUFqKtZcGJJef2kIhwqe1L5oW0RBRk5XJvOtVWkxobEuRq28f76+j
9+gtNW9O12tTXEg+nGR5KOWd+UEOCtLyCgs2YMfUwloGYzc26lw9n77VI7g0RC
ViiNdZLGWlg2ywFBXGVBHeuo2a8NHXxOTuFdPdBP0UCodknzd+Af761FZPJDg0
HEvFzHUpoEExn00NzBUj0YvkUMtOXi4Q9GNB1V7UUiAJNwUZXjbjRgbUXfSMcZ
ZY9LkHoc4cq5F4w+IN8O4KLkTfzLENdbbFP04R2BJ5ASx4r7GADaeCMaXUYuqU
DjP5gGDIG0lHXSnn31tPBZeVX+AcYEmDU2Zbch5PxPs=
-----END RSA PRIVATE KEY-----

16. Private Key [root@linux conf]# openssl rsa -noout -text -in server.key
read RSA key
Enter PEM pass phrase:
Private-Key: (512 bit)
modulus:
00:a3:f6:5c:c5:39:72:54:80:41:94:6a:a0:ae:0c:
7c:eb:d8:ac:f5
publicExponent: (0x10001)
privateExponent:
10:08:c2:af:c2:db:6c:6a:12:7f:ba:21:b6:83:9e:
fa:e3:74:e1
prime1:
00:d3:a3:99:4f:43:ba:b3:97:a3:bc:58:e3:58:ce:
c6:9a:ad
prime2:
00:c6:54:77:29:cf:8d:8c:6a:f0:76:e5:61:db:c3:
33:ac:69

17. Certificate Signing Request

18. make CSR [root@linux conf]# make server.csr umask 77 ; \
/usr/bin/openssl req -new -key server.key -out server.csr
Using configuration from /usr/share/ssl/openssl.cnf
Enter PEM pass phrase:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----

19. Make CSR ... Country Name (2 letter code) [AU]:ID
State or Province Name (full name) [Some-State]:DKI
Locality Name (eg, city) []:Jakarta
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Free Agent
Organizational Unit Name (eg, section) []:Owner
Common Name (eg, your name or your server's hostname) []:
Address
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:apa kabar
An optional company name []:purbo.org
conf]#

20. Server.csr
This is the server certificate signing request for Apache/mod_ssl corresponding to the ../ssl.crt/server.crt file.
Then it contains the CSR which you can send to a public Certification Authority (CA) for requesting a real signed certificate (which then can replace the ../ssl.crt/server.crt file).

21. More server.csr [root@linux conf]# more server.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIBezCCASUCAQAwgYsxCzAJBgNVBAYTAklEMQwwCgYDVQQIEwNES0kxEDAOBg
BAcTB0pha2FydGExEzARBgNVBAoTCkZyZWUgQWdlbnQxDjAMBgNVBAsTBU93bm
MRYwFAYDVQQDEw13d3cucHVyYm8ub3JnMR8wHQYJKoZIhvcNAQkBFhBvbm5vQG
ZG8ubmV0LmlkMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKP2XMU5clSAQZRqoK
aHiFnbiIcyt/vgx301kwmkH1DdRncuR74mIPAjSxA9Mik5cPUOUtCQmw7LCbfO
rPUCAwEAAaA0MBgGCSqGSIb3DQEJAjELEwlwdXJiby5vcmcwGAYJKoZIhvcNAQ
MQsTCWFwYSBrYWJhcjANBgkqhkiG9w0BAQQFAANBADnl/mBcXOkFv6I8PV5oWC
BH5Ppxx0T4bON2vaE2DPiEdneWdbt5QoJBw7AO1zWuGSxhQDEx4RaEx6sEfXX2
-----END CERTIFICATE REQUEST-----
conf]#

22. Server.csr [root@linux conf]# openssl req -noout -text -in server.csr
Using configuration from /usr/share/ssl/openssl.cnf
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=ID, ST=DKI, L=Jakarta, O=Free Agent, OU=Owner,
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (512 bit)
Modulus (512 bit):
00:a3:f6:5c:c5:39:72:54:80:41:94:6a:a0:ae:0c:
03:d3:22:93:97:0f:50:e5:2d:09:09:b0:ec:b0:9b:
7c:eb:d8:ac:f5
Exponent: (0x10001)

23. Server.csr .. Attributes: unstructuredName :purbo.org
challengePassword :apa kabar
Signature Algorithm: md5WithRSAEncryption
39:e5:fe:60:5c:5c:e9:05:bf:a2:3c:3d:5e:68:58:2f:9b:04:
7e:4f:a7:1c:74:4f:86:ce:37:6b:da:13:60:cf:88:47:67:79:
67:5b:b7:94:28:24:1c:3b:00:ed:73:5a:e1:92:c6:14:03:13:
1e:11:68:4c:7a:b0:47:d7:5f:6d
conf]#

24. Digital Certificate (Self Signed)

25. Make CRT [root@linux conf]# [root@linux conf]# make server.crt
umask 77 ; \
/usr/bin/openssl req -new -key server.key -x509 -days 365 -out server.crt
Using configuration from /usr/share/ssl/openssl.cnf
Enter PEM pass phrase:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

26. Make CRT .. ----- Country Name (2 letter code) [AU]:ID
State or Province Name (full name) [Some-State]:DKI
Locality Name (eg, city) []:Jakarta
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Free Agent
Organizational Unit Name (eg, section) []:Owner
Common Name (eg, your name or your server's hostname) []:
Address
conf]#

27. /etc/httpd/conf/ssl.crt
The ssl.crt/ directory of Apache/mod_ssl where PEM-encoded X.509 Certificates for SSL are stored.
server.crt - is the server certificate for Apache/mod_ssl, configured with the SSLCertificateFile directive.

28. More server.crt [root@linux conf]# more server.crt
-----BEGIN CERTIFICATE-----
MIIC9TCCAp+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCSU
DDAKBgNVBAgTA0RLSTEQMA4GA1UEBxMHSmFrYXJ0YTETMBEGA1UEChMKRnJlZS
Z2VudDEOMAwGA1UECxMFT3duZXIxFjAUBgNVBAMTDXd3dy5wdXJiby5vcmcxHz
BgkqhkiG9w0BCQEWEG9ubm9AaW5kby5uZXQuaWQwHhcNMDEwNTAzMDE0MTE1Wh
MDIwNTAzMDE0MTE1WjCBizELMAkGA1UEBhMCSUQxDDAKBgNVBAgTA0RLSTEQMA
A1UEBxMHSmFrYXJ0YTETMBEGA1UEChMKRnJlZSBBZ2VudDEOMAwGA1UECxMFT3
ZXIxFjAUBgNVBAMTDXd3dy5wdXJiby5vcmcxHzAdBgkqhkiG9w0BCQEWEG9ubm
aW5kby5uZXQuaWQwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAo/ZcxTlyVIBBlG
rgxoeIWduIhzK3++DHfTWTCaQfUN1Gdy5HviYg8CNLED0yKTlw9Q5S0JCbDssJ
69is9QIDAQABo4HrMIHoMB0GA1UdDgQWBBT995mg/pKwzq5yZSSK9jCpxRzbtT
uAYDVR0jBIGwMIGtgBT995mg/pKwzq5yZSSK9jCpxRzbtaGBkaSBjjCBizELMA
A1UEBhMCSUQxDDAKBgNVBAgTA0RLSTEQMA4GA1UEBxMHSmFrYXJ0YTETMBEGA1
ChMKRnJlZSBBZ2VudDEOMAwGA1UECxMFT3duZXIxFjAUBgNVBAMTDXd3dy5wdX
Qw4hIPMdJ5eer6qBUaiIl5G9yurxeAOPkSd58OVsmX1KwQIm2kLZtwY=
-----END CERTIFICATE-----
conf]#

29. Server.crt [root@linux conf]# openssl x509 -noout -text -in server.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: md5WithRSAEncryption
Issuer: C=ID, ST=DKI, L=Jakarta, O=Free Agent, OU=Owner, CN=
Validity
Not Before: May 3 01:41: GMT
Not After : May 3 01:41: GMT
Subject: C=ID, ST=DKI, L=Jakarta, O=Free Agent, OU=Owner, CN=
Subject Public Key Info:

30. Server.crt .. Public Key Algorithm: rsaEncryption
RSA Public Key: (512 bit)
Modulus (512 bit):
00:a3:f6:5c:c5:39:72:54:80:41:94:6a:a0:ae:0c:
Exponent: (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
FD:F7:99:A0:FE:92:B0:CE:AE:72:65:24:8A:F6:30:A9:
X509v3 Authority Key Identifier:
keyid:FD:F7:99:A0:FE:92:B0:CE:AE:72:65:24:8A:
DirName:/C=ID/ST=DKI/L=Jakarta/O=Free
serial:00
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: md5WithRSAEncryption
8d:af:9e:12:ee:90:42:e4:0c:fc:40:dd:f7:b0:08:6f:17:d5:
conf]#

31. Testing s_client

32. S_client [root@linux conf]# openssl s_client -host localhost -port 443
CONNECTED( )
depth=0 /C=ID/ST=DKI/L=Jakarta/O=Free Agent/OU=Owner/CN=
@indo.net.id
verify error:num=18:self signed certificate
verify return:1
---
Certificate chain
0 s:/C=ID/ST=DKI/L=Jakarta/O=Free
i:/C=ID/ST=DKI/L=Jakarta/O=Free

33. S_client
Command Line
conf]# openssl s_client -host localhost -port 443
CONNECTED( )
depth=0 /C=ID/ST=DKI/L=Jakarta/O=Free Agent/OU=Owner/CN=
@indo.net.id
verify error:num=18:self signed certificate
verify return:1
---
Certificate chain
0 s:/C=ID/ST=DKI/L=Jakarta/O=Free
i:/C=ID/ST=DKI/L=Jakarta/O=Free

34. S_client Self Sign Cerificate
conf]# openssl s_client -host localhost -port 443
CONNECTED( )
depth=0 /C=ID/ST=DKI/L=Jakarta/O=Free Agent/OU=Owner/CN=
@indo.net.id
verify error:num=18:self signed certificate
verify return:1
---
Certificate chain
0 s:/C=ID/ST=DKI/L=Jakarta/O=Free
i:/C=ID/ST=DKI/L=Jakarta/O=Free
Self Sign Cerificate

35. S_client .. --- Server certificate -----BEGIN CERTIFICATE-----
MIIC9TCCAp+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCSU
DDAKBgNVBAgTA0RLSTEQMA4GA1UEBxMHSmFrYXJ0YTETMBEGA1UEChMKRnJlZS
Qw4hIPMdJ5eer6qBUaiIl5G9yurxeAOPkSd58OVsmX1KwQIm2kLZtwY=
-----END CERTIFICATE-----
subject=/C=ID/ST=DKI/L=Jakarta/O=Free
issuer=/C=ID/ST=DKI/L=Jakarta/O=Free

36. S_client .. Siapa Anda.. --- Server certificate
-----BEGIN CERTIFICATE-----
MIIC9TCCAp+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCSU
DDAKBgNVBAgTA0RLSTEQMA4GA1UEBxMHSmFrYXJ0YTETMBEGA1UEChMKRnJlZS
Qw4hIPMdJ5eer6qBUaiIl5G9yurxeAOPkSd58OVsmX1KwQIm2kLZtwY=
-----END CERTIFICATE-----
subject=/C=ID/ST=DKI/L=Jakarta/O=Free
issuer=/C=ID/ST=DKI/L=Jakarta/O=Free
Siapa Anda..

37. Issuer / Cerificate Authority
S_client ..
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC9TCCAp+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCSU
DDAKBgNVBAgTA0RLSTEQMA4GA1UEBxMHSmFrYXJ0YTETMBEGA1UEChMKRnJlZS
Qw4hIPMdJ5eer6qBUaiIl5G9yurxeAOPkSd58OVsmX1KwQIm2kLZtwY=
-----END CERTIFICATE-----
subject=/C=ID/ST=DKI/L=Jakarta/O=Free
issuer=/C=ID/ST=DKI/L=Jakarta/O=Free
Issuer / Cerificate Authority

38. S_client .. --- No client certificate CA names sent
SSL handshake has read 1221 bytes and written 314 bytes
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
Server public key is 512 bit
SSL-Session:
Protocol : TLSv1
Cipher : EDH-RSA-DES-CBC3-SHA
Session-ID:
Session-ID-ctx:
Master-Key: F597E6EEDB4B6C6FADFC7AEDDC0E66F4740E7EB8486F03
Key-Arg : None
Start Time:
Timeout : 300 (sec)
Verify return code: 0 (ok)

39. S_client .. Master Key --- No client certificate CA names sent
SSL handshake has read 1221 bytes and written 314 bytes
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
Server public key is 512 bit
SSL-Session:
Protocol : TLSv1
Cipher : EDH-RSA-DES-CBC3-SHA
Session-ID:
Session-ID-ctx:
Master-Key: F597E6EEDB4B6C6FADFC7AEDDC0E66F4740E7EB8486F03
Key-Arg : None
Start Time:
Timeout : 300 (sec)
Verify return code: 0 (ok)
Master Key

40. S_client ..
---
GET /
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
<TITLE>Test Page for the Apache Web Server on Red Hat Linux</TITLE>
</HEAD>
<!-- Background white, links blue (unvisited), navy (visited), red (active) --> <BODY BGCOLOR="#FFFFFF">
<H1 ALIGN="CENTER">Test Page</H1>
This page is used to test the proper operation of the Apache Web server after it has been installed. If you can read this page, it means that the Apache Web server installed at this site is working properly.
</HTML>
closed
conf]#