| Excerpt |
|---|
Derscripes howto setup a webserver for file exchange in a Bit Repository system. |
Creating a certificate authority for test
| No Format |
|---|
$ mkdir /path/to/ca/ # CA root
$ mkdir /path/to/ca/ca.db.certs # Signed certificates
$ touch /path/to/ca/ca.db.index # Index of signed certificates
$ echo 01 > /path/to/ca/ca.db.serial # Next (sequential) serial number
$ cp ca.conf /path/to/ca/ # Configuration file (see below)
$ cd /path/to/ca
$ openssl genrsa -out ca.key 1024 # Generate CA private key
$ openssl req -new -key ca.key \
-out ca.csr # Create Certificate Signing Request
$ openssl x509 -req -days 10000 \
-in ca.csr \
-out ca.crt \
-signkey ca.key # Create self-signed certificate
|
ca.conf:
| No Format |
|---|
[ ca ]
default_ca = ca_default
[ ca_default ]
dir = ./ca
certs = $dir
new_certs_dir = $dir/ca.db.certs
database = $dir/ca.db.index
serial = $dir/ca.db.serial
RANDFILE = $dir/ca.db.rand
certificate = $dir/ca.crt
private_key = $dir/ca.key
default_days = 365
default_crl_days = 30
default_md = md5
preserve = no
policy = generic_policy
[ generic_policy ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
|
Creating and signing webserver certificate:
| No Format |
|---|
$ openssl genrsa -out server.key 1024 # Create private/public key pair for server
$ openssl req -new -key server.key \
-out server.csr # Create certificate signing request
# (Remember: Common name *MUST* match server address)
$ openssl ca -config ca.conf \
-in server.csr \
-cert ca.crt \
-keyfile ca.key \
-out server.crt # Sign certificate request with CA certificate.
# Create PEM file with the server key and certificate for use with lightttpd
$ cat server.key server.crt > server.pem
|
References:
Client certificates with apache
Lighttpd
Enabling upload (WebDAV):
Add "mod_webdav" to server.modules, and configure it:
| Code Blocknoformat |
|---|
webdav.activate = "enable" webdav.is-readonly = "disable" webdav.sqlite-db-name = "/var/run/lighttpd/lighttpd.webdav_lock.db" |
Enabling SSL (HTTPS) on port 443:
| Code Blocknoformat |
|---|
$SERVER["socket"] == ":443" {
ssl.engine = "enable"
ssl.pemfile = "/path/to/server.pem" # a PEM file is a combination of a key and certificate
ssl.ca-file = "/path/to/ca.crt" # This is the CA file used to sign the above key (if needed, which it is for self-signed certificates)
}
|
To enable client authentication add the following to the configuration:
| Code Blocknoformat |
|---|
ssl.verifyclient.activate = "enable"
ssl.verifyclient.enforce = "enable"
#ssl.verifyclient.depth = "1" # Should possibly be enabled in the future
ssl.verifyclient.username = "SSL_CLIENT_S_DN_CN"
|
...