📄 impl-openca.htm
字号:
<HTML><HEAD><TITLE>The OpenCA Project[TODO]</TITLE><METANAME="GENERATOR"CONTENT="Modular DocBook HTML Stylesheet Version 1.55"><LINKREL="HOME"TITLE="The Open–source PKI Book"HREF="ospki-book.htm"><LINKREL="UP"TITLE="Open-Source Implementations"HREF="implementations.htm"><LINKREL="PREVIOUS"TITLE="Open-Source Implementations"HREF="implementations.htm"><LINKREL="NEXT"TITLE="The Oscar Public Key Infrastructure Project"HREF="impl-oscar.htm"></HEAD><BODYCLASS="SECT1"BGCOLOR="#FFFFFF"TEXT="#000000"LINK="#0000FF"VLINK="#840084"ALINK="#0000FF"><DIVCLASS="NAVHEADER"><TABLEWIDTH="100%"BORDER="0"CELLPADDING="0"CELLSPACING="0"><TR><THCOLSPAN="3"ALIGN="center">The Open–source PKI Book: A guide to PKIs and Open–source Implementations</TH></TR><TR><TDWIDTH="10%"ALIGN="left"VALIGN="bottom"><AHREF="implementations.htm">Prev</A></TD><TDWIDTH="80%"ALIGN="center"VALIGN="bottom">Chapter 7. Open-Source Implementations</TD><TDWIDTH="10%"ALIGN="right"VALIGN="bottom"><AHREF="impl-oscar.htm">Next</A></TD></TR></TABLE><HRALIGN="LEFT"WIDTH="100%"></DIV><DIVCLASS="SECT1"><H1CLASS="SECT1"><ANAME="IMPL-OPENCA">The OpenCA Project[TODO]</A></H1><P> OpenCA is a collaborative effort to create a public–key infrastructure. Programmatically, it resembles pyCA with the exception of using Perl instead of Python for the CGI scripts. It uses OpenSSL for the underlying cryptograpgic infrastructure. OpenCA is distributed with an Apache–style license. </P><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="OPENCA-DESCRIPTION-LAYOUT">OpenCA Layout</A></H2><P> We describe the CA structure as used currently in OpenCA. <DIVCLASS="FIGURE"><ANAME="OPENCA-LAYOUT"></A><P><B>Figure 7-1. Current OpenCA Layout</B></P><P><IMGSRC="figures/OpenCA-diagram.gif"></P></DIV> </P><P> The Certification Authority –– for security reasons and in accordance with the current layout –– should not be networked. It manually communicates with the Registration Authority, perhaps using removable media. </P><P> The Registration Authority should not have direct access to the Internet but be accessed through the RA Operator. </P><P> The RA Operator is the interface of OpenCA between users and the Internet. </P></DIV><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="OPENCA-ABBREV">OpenCA Abbreviations</A></H2><P> Throughout the documentation we use the following terminology. <DIVCLASS="TABLE"><P><B>Table 7-1. OpenCA Abbreviations</B></P><TABLEBORDER="1"CLASS="CALSTABLE"><THEAD><TR><THALIGN="LEFT"VALIGN="TOP">Term</TH><THALIGN="LEFT"VALIGN="TOP">OpenCA Object Name</TH></TR></THEAD><TBODY><TR><TDALIGN="LEFT"VALIGN="TOP">Certification Authority</TD><TDALIGN="LEFT"VALIGN="TOP">CAServer</TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP">Registration Authority</TD><TDALIGN="LEFT"VALIGN="TOP">RAServer</TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP">RA Operator</TD><TDALIGN="LEFT"VALIGN="TOP">RAOperator</TD></TR></TBODY></TABLE></DIV> </P><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="100%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><TDALIGN="LEFT"VALIGN="TOP"><P> The reader should notice the difference between the CA as an organisation or a company and the CA as CAServer. Currently, we do not differentiate explicitly and the user has to identify the correct meaning by the context. </P></TD></TR></TABLE></DIV><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="100%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><TDALIGN="LEFT"VALIGN="TOP"><P> In several parts of the documents we use the terms Certificate Signing Request and requests to describe the same thing. The latter term is common in programming contexts. </P></TD></TR></TABLE></DIV></DIV><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="SOFTWARE-TYPE">Software packages</A></H2><P> This is the basic software used to implement OpenCA. Current (May, 2000) versions are depicted in the table following the list. <P></P><OLTYPE="1"><LI><P> Compatible Operating system like <SPANCLASS="TRADEMARK">Linux </SPAN>®, available from <AHREF="http://www.linux.org"TARGET="_top">http://www.linux.org</A> </P></LI><LI><P> OpenSSL, available from <AHREF="http://www.openssl.org"TARGET="_top">http://www.openssl.org</A> </P></LI><LI><P> Apache WWW Server, available from <AHREF="http://www.apache.org"TARGET="_top">http://www.apache.org</A> </P></LI><LI><P> mod–ssl Apache module, available from <AHREF="http://www.modssl.org"TARGET="_top">http://www.modssl.org</A> </P></LI><LI><P> OpenLDAP, available from <AHREF="http://www.openldap.org"TARGET="_top">http://www.openldap.org</A> </P></LI></OL> </P><P> We subsequently install the OpenCA software. At the time of writing, the latest version is 0.2.0, available at <AHREF="http://www.openca.org/download.shtml"TARGET="_top"> http://www.openca.org/download.shtml</A> </P><DIVCLASS="TABLE"><P><B>Table 7-2. Current Versions of OpenCA prerequisite software</B></P><TABLEBORDER="1"CLASS="CALSTABLE"><THEAD><TR><THALIGN="LEFT"VALIGN="TOP">Software</TH><THALIGN="LEFT"VALIGN="TOP">Current version</TH></TR></THEAD><TBODY><TR><TDALIGN="LEFT"VALIGN="TOP"><SPANCLASS="TRADEMARK">RedHat</SPAN>®Linux</TD><TDALIGN="LEFT"VALIGN="TOP"><TTCLASS="LITERAL">6.2</TT></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP">OpenSSL SSL/TLS software</TD><TDALIGN="LEFT"VALIGN="TOP"><TTCLASS="LITERAL">0.9.5a</TT></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP">Apache WWW Server</TD><TDALIGN="LEFT"VALIGN="TOP"><TTCLASS="LITERAL">1.3.12</TT></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP">modssl SSL/TLS Apache module</TD><TDALIGN="LEFT"VALIGN="TOP"><TTCLASS="LITERAL">2.6.4</TT></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP">OpenLDAP LDAP software</TD><TDALIGN="LEFT"VALIGN="TOP"><TTCLASS="LITERAL">1.2.10</TT></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP">Perl interpreter</TD><TDALIGN="LEFT"VALIGN="TOP"><TTCLASS="LITERAL">5.6.0</TT></TD></TR></TBODY></TABLE></DIV></DIV><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="FUNCTIONALITYCA">Functionality of the CA Server <ICLASS="EMPHASIS">(CAServer)</I></A></H2><P> The functionality of the Certification Authority Server is: </P><P> The source code describes the <SPANCLASS="ACRONYM">CA</SPAN> server as <ICLASS="EMPHASIS">CAServer</I>. </P><P> The following sections and subsections are the options presented to the user by the WWW interface to administer the CA. This interface is the recommended method of administration. </P><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="100%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><TDALIGN="LEFT"VALIGN="TOP"><P> The content of this section is subject to change in the future. </P></TD></TR></TABLE></DIV><DIVCLASS="SECT3"><H3CLASS="SECT3"><ANAME="CA-INITALISATION">Initialisation / CA Management</A></H3><P> <P></P><UL><LI><P> Generate new CA private key </P><P> This procedure is described in <AHREF="keygensign.htm#GENERATEKEY">the section called <I>Generate the RSA key–pair for a user/server</I> in Chapter 4</A>. Generating a new secret (private) key for a CA and overwriting the old one is an important procedure, since previously–issued certificates become invalid. The user is warned that the current CA private key will be overwritten. </P><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="90%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><TDALIGN="LEFT"VALIGN="TOP"><P> In fact, with the current version of OpenCA, the previous current key is not overwritten, as the software saves the current key in a file with an extension of .old. However, previous any previous keys are overwritten. </P></TD></TR></TABLE></DIV><P> The user is prompted with a dialog box for the CA secret key. This <ICLASS="EMPHASIS">CA secret key</I> is in fact the <ICLASS="EMPHASIS">pass–phrase</I> that protects the CA private key. For example, if we use <SPANCLASS="ACRONYM">RSA</SPAN> as the public key algorithm, the key generation procedure generates a set of very large numbers. A part of them constitute the private key. This information must not be compromised. In order to make it more secure, we encrypt this information with a block cipher like <SPANCLASS="ACRONYM">DES</SPAN>, <SPANCLASS="ACRONYM">Triple–DES</SPAN> or <SPANCLASS="ACRONYM">IDEA</SPAN>. Subsequently, when there is a need to have the value of the private key, the application asks us for the pass–phrase, decrypts the encrypted private key, and uses it. </P><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="90%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><TDALIGN="LEFT"VALIGN="TOP"><P> Safe choices for an encryption algorithm are Triple–DES (<SPANCLASS="ACRONYM">3DES</SPAN> or sometimes written <SPANCLASS="ACRONYM">DES3</SPAN>) and <SPANCLASS="ACRONYM">IDEA</SPAN>. <SPANCLASS="ACRONYM">DES</SPAN> is not considered a safe choice, unless key recovery is an issue. <TTCLASS="LITERAL">:)</TT> Apart from the joke, the user should be aware that using high–grade encryption does not mean that the system is secure. All components of a system need to be secure in order to have a secure system. In the case of OpenCA, there are a lot of components. </P></TD></TR></TABLE></DIV><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="90%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><TDALIGN="LEFT"VALIGN="TOP"><P> It is common practice that once the private key is used by the application, it should not be kept in the computer's memory any longer. When there is a need for the private key, the application should ask for it. This is more secure but requires human intervention when there is a need for the private key. For example, when we need to restart a server. </P></TD></TR></TABLE></DIV><P> Next the user is asked for the size of the CA key in bits. This is the size of N in RSA, the product of the two large prime numbers. This affects the security of the Certification Authority. </P><P> A choice of 512 bits is not considered safe while one of 1024 bits is considered relatively safe. 2048 bits are considered to be a secure choice with current (May, 2000) information about factorisation. </P><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="90%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><TDALIGN="LEFT"VALIGN="TOP"><P> Consider that when the key length rises, so does the time needed to generate and do operations with the keys. For instance, on a <SPANCLASS="TRADEMARK">Pentium</SPAN>® Pro computer, generating a key of size 1024 bits requires approximately 3 seconds; 2048 bits requires around 13 seconds. The tests were carried out using the OpenSSL software and running the <SPANCLASS="TRADEMARK">Linux</SPAN>® operating system. Key generation takes place once in the lifetime of the key. Other operations, like the signing and verification of digital signatures, take place more frequently and remain to be benchmarked. </P></TD></TR></TABLE></DIV><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="90%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><TDALIGN="LEFT"VALIGN="TOP"><P> With <SPANCLASS="TRADEMARK">Pentium</SPAN>® II or better computers, the size of 2048 bits is both a fast and secure choice. Once we click OK, the key–generation takes place. This takes several seconds. The user should wait for it to complete. </P></TD></TR></TABLE></DIV><P> You can find a sample encrypted private key in PEM format at <AHREF="sample-openssl-usage.htm#SAMPLE-PRIV-ENC-KEY">the section called <I>Sample Encrypted Private Key in PEM format (2048 bits)</I> in Appendix B</A>. </P></LI><LI><P>Generate new CA Certificate Signing Request</P><P> This is the procedure described in <AHREF="keygensign.htm#GENERATECSR">the section called <I>Generate a certificate request</I> in Chapter 4</A>. Essentially, the certificate request is generated to be later self–signed with the public key of the CA, generated with the previous option. </P></LI><LI><P>Export CA Certificate Request</P><P>This option exports the CA certificate request generated above. A file is created in the file system that corresponds with the CSR.</P></LI><LI><P>Generate Self–Signed CA Certificate</P><P>This option uses the generated CSR to create the CA Certificate. It signs it with the public key of the CA. </P></LI><LI><P>Export CA Certificate</P><P>This option exports the generated CA Certificate or⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -