How to Renew Certificate with OpenSSL

SSL certificates are valid for certain period of time, usually 365 days. If you are using self signed certificates at some point of time you will need renew them, otherwise services that utilize them "unexpectedly" stop working. That actually greatly depends on client configuration, so if client demand valid server certificate it will not proceed any further.

Suppose your certificate private key (original request) is in file my-key.pem and signed certificate in my-cert.pem.

Validate Certificate

Validate certificate by issuing the following command:

openssl verify my-cert.pem

Here is a sample output of checking valid cerificate:

my-cert.pem: OK

Expired:

my-cert.pem: ...
error 10 at 0 depth lookup:certificate has expired
OK

If verification of certificate shows it expired, you need renew it.

Renew Certificate

Renewal of expired certificate consists of two steps: revoke old one, sign certificate request.

1. Revoke expired certificate (you will be asked for Certificate Authority password):

   ca1:~/ca# openssl ca -revoke my-cert.pem 
   Using configuration from /usr/lib/ssl/openssl.cnf
   Enter pass phrase for ./demoCA/private/cakey.pem:
   Revoking Certificate EFDAF4493BC3D5BB.
   Data Base Updated
   

2. Rename you certificate key (request) file to newreq.pem.

   ca1:~/ca# mv my-key.pem newreq.pem
   ca1:~/ca# /usr/lib/ssl/misc/CA.sh -sign
   ...
   Signed certificate is in newcert.pem
   

At this point renewed certificate is in newcert.pem.

Troubleshooting

If you get error like this one below:

failed to update database
TXT_DB error number 2

You must revoke previous certificate from CA database.

How to rewrite all to https in nginx

Here we are going redirect all http traffic to https with nginx. I suppose you already have nginx installed, if not have a look here. We will store SSL certificates in /etc/nginx/ssl directory.

cd /etc/nginx
mkdir ssl
openssl req -new -x509 -sha256 -days 9999 -nodes \
    -out ssl/cert.pem -keyout ssl/cert.key
chown -R www-data:www-data ssl
chmod -R 700 ssl

Here is nginx configuration:

upstream backend {
    server 127.0.0.1:8080;
}

server {
    listen  *:80;
    return 301 https://$host$request_uri;
    #if ( $scheme = "http" ) {
    #    rewrite  ^/(.*)$  https://$host/$1 permanent;
    #}
}

server {
    listen  *:443;

    ssl on;
    ssl_protocols TLSv1;
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/cert.key;

    location / {
        proxy_pass http://backend;
    }
}

You have to reload nginx so the changes take place.

Exim4 SSL/TLS Configuration

Here we are going configure exim4 to use SSL/TLS for incoming connections:

1. First of all let create an exim4 certificate request (see here how to create a certificate authority):

   openssl req -newkey rsa:2048 -keyout exim.key -out exim.csr -days 3650 -nodes
   

2. Now let sign it with our certificate authority:

   openssl ca -out exim.crt -infiles exim.csr
   

3. Here we get two important files: exim.key (that is private key) and exim.crt (x509 certificate file). Let copy them to /etc/exim4
4. Secure certificates:

   chown root:Debian-exim exim.key exim.crt
   chmod g=r,o= exim.key exim.crt
   

5. Enable exim4 daemon listening options for ports 25 and 465 (file /etc/default/exim4):

   SMTPLISTENEROPTIONS='-oX 465:25 -oP /var/run/exim4/exim.pid'
   

6. Turn on SSL/TLS option (new file /etc/exim4/conf.d/main/00_exim4-localmacros):

   MAIN_TLS_ENABLE = true
   

7. Restart exim4 and have a look at log file when you send a test message.

   /etc/init.d/exim4 restart
   echo test | mail -s "ssl/tls test" root@dev.local
   

   Here is what you will see in log file (/var/log/exim4/mainlog):

   ... P=esmtps X=TLS1.0:RSA_AES_256_CBC_SHA1:32 ...
   

   If for some reason you can not see esmtps message in log file it most likely it doesn't use SSL/TLS for local delivery, try from remote machine.

Alternative Certificate Location

You can specify any location for ssl/tls certificate (file /etc/exim4/conf.d/main/00_exim4-localmacros):

MAIN_TLS_CERTIFICATE=/etc/ssl/certs/mail.dev.local-cert.pem
MAIN_TLS_PRIVATEKEY=/etc/ssl/private/mail.dev.local-key.pem

This is useful when you host both SMTP and IMAP services on the same host. Note, group Debian-exim must have read access to both files.

How to add CA certificate to Common CA certificates

Debian package ca-certificates installs a number of common CA certificates, well known. Your certificate authority is not there, so you will get a warning messages every time it used by browser, mail client, IM, etc. Here are few simple steps to install your own CA certificate.

apt-get install ca-certificates

Copy CA certificate and reconfigure ca-certificates package:

cp cacert.pem /usr/share/ca-certificates
dpkg-reconfigure ca-certificates

You will be asked "Trust new certificates from certificate authorities?", choose Ask than from the list of activated certificates mark yours. This will rebuild certificates database with your CA certificate.

Apache Basic Authentication over SSL with PAM Kerberos/LDAP

Suppose you already have a web site serving multiple subversion repositories over SSL (see here) and you would like add security on top of that, namely use Kerberos for authentication and LDAP for authorization. Before we proceed please ensure your machine is capable to authenticate against Kerberos/LDAP (see here). I will assume you saw the following:

• Serving Multiple SVN Repositories with Apache (see here)
• Debian OpenLDAP client with Kerberos (see here)

Serving Multiple SVN Repositories with Apache

Here are our requirements:

• SVN web server FQDN: scm1 ; scm1.dev.local
• SVN is served via SSL only
• Repositories access url: https://scm1/svn/project1, https://scm1.dev.local/svn/project2
• Access: public
• Policies: /var/lib/svn/conf/policies
• Root: /var/lib/svn/repos

Before we proceed please see:

• Apache with SSL (see here)
• Revision control with subversion (see here). You can skip settings related to security permissions, etc since the authentication/authorization will be managed by apache.

Apache with SSL

Here we are going setup a web site with SSL support, so content can be securely served via https.

• Web server FQDN: web1 ; web1.dev.local
• Content served via: HTTP and HTTPS
• Content location: /var/www/

How to add CA certificate to NSS Certificate DB

If you have created a Certificate Authority (see here), you probably want get rid of warnings the consumers shows to your users, e.g. email clients while accessing the mailbox. Here are few simple steps to add your local Certificate Authority to to NSS Certificate DB:

1. Copy CA certificate to known certificates:

   cp cacert.pem /etc/ssl/certs
   chmod go+r /etc/ssl/certs/cacert.pem
   

2. Let install a tools to manage NSS Certificate DB:

   apt-get install libnss3-tools
   

3. The default location of NSSDB is in $HOME/.pki/nssdb. If you do not have one yet issue the following command to create (see more baout certutil here):

   mkdir -p .pki/nssdb ; certutil -N -d sql:.pki/nssdb
   

4. Add CA certificate:

   certutil -d sql:.pki/nssdb -A -t "CT,c,c" -n DEV.LOCAL \
   -i /etc/ssl/certs/cacert.pem
   

Evolution email client

Nothing specific need to be done. It uses .pki/nssdb by default

Firefox/Iceweasel web browser

The idea here is to point existing nssdb files to one in .pki/nssdb:

cd .mozilla/firefox/your-profile/
rm cert9.db key4.db
ln -s ~/.pki/nssdb/key4.db .
ln -s ~/.pki/nssdb/cert9.db .

Thunderbird email client

Things you need to do are exactly the same as for firefox, with the only exception to change default directory to .thunderbird/your-profile instead.

Final Note

At this point you should be fine to see SSL content (web, mail, etc) without a security warning since your CA is trusted. Consider copy nss db to /etc/skel, so the new users will get it working automatically:

cp -r .pki /etc/skel

The first time a new user logging, the nssdb will be copied from skel directory and as result the user will get valid CA certificate. Read more here.

Dovecot IMAP Server

The Internet Message Access Protocol (IMAP) is one of the two most prevalent Internet standard protocols for e-mail retrieval. Dovecot is an open source IMAP.

• IMAP host FQDN: mail1.dev.local, ip: 192.168.10.11, DNS alias: mail.dev.local
• Mailbox type: Maildir
• Mail location: /var/mail/<user>
• Communication: Only secure, TLS/SSL

Basic Installation

Here are few simple steps to configure: Let install dovecot:

apt-get -y install dovecot-imapd

Dovecot V1.x Configuration

Ensure imaps in the following configuration (file /etc/dovecot/dovecot.conf):

protocols = imap imaps
mail_location = maildir:/var/mail/%u

Dovecot V2.0 Configuration

Setup mail location (file /etc/dovecot/conf.d/10-mail.conf)

mail_location = maildir:/var/mail/%u

SSL

1. Create SSL certificate (see here). While answering questions make sure the following (this is the name the clients will access your IMAP server):

   Common Name (eg, YOUR name) []:mail.dev.local
   

   There are two important files we created here: newreq.pem and newcert.pem. Rename those files:

   mv newreq.pem mail-key.pem
   mv newcert.pem mail-cert.pem
   

2. Copy these files:

   cp mail-cert.pem /etc/ssl/certs
   cp mail-key.pem /etc/ssl/private
   

3. Dovecot V1.x Configuration

   Let dovecot know about our certificates (file /etc/dovecot/dovecot.conf):

   ssl_cert_file = /etc/ssl/certs/mail-cert.pem
   ssl_key_file = /etc/ssl/private/mail-key.pem
   

   Dovecot V2.0 Configuration

   Let dovecot know about our certificates (file /etc/dovecot/conf.d/10-ssl.conf):

   ssl_cert = </etc/ssl/certs/mail-cert.pem
   ssl_key = </etc/ssl/private/mail-key.pem
   

4. Restart dovecot:

   /etc/init.d/dovecot restart
   

You should be able access the mail via IMAP TLS/SSL now. See here how to get rid of warning message about the SSL certificate signature by mail clients, e.g. Evolution, etc.

Troubleshooting: namespace missing

While upgrading to dovecot v2.1.7 I noticed the following error:

mail1 dovecot: imap(xxx): Error: user xxx: Initialization failed: 
namespace configuration error: inbox=yes namespace missing
mail1 dovecot: imap(xxx): Error: Invalid user settings. Refer to 
server log for more information.

You need define inbox namespace and explicitly set the `inbox` attribute (file /etc/dovecot/conf.d/10-mail.conf)

namespace inbox {
    inbox = yes
}

Restart dovecot and that fix it.

Configuring OpenLDAP with SSL/TLS on Debian

It is recommended that communication between clients and ldap server be encrypted. Before we enable encryption for ldap server we need SSL private key and certificate signed by certificate authority. Have a look at OpenSSL Certificates. Suppose here are your files: ldap.dev.local-key.pem and ldap.dev.local-cert.pem.

Server

1. Install CA certificate:

   cp ~/ca/demoCA/cacert.pem /etc/ssl/certs/
   chmod go+r /etc/ssl/certs/cacert.pem
   

2. Copy ldap key and certificate files to /etc/ldap/ssl

   mkdir /etc/ldap/ssl/
   cp ~/ca/ldap.dev.local-*.pem /etc/ldap/ssl/
   

3. Secure certificates:

   ldap1:~# chown -R root:openldap /etc/ldap/ssl
   ldap1:~# chmod -R o-rwx /etc/ldap/ssl
   

4. Enable ldaps protocol (file /etc/default/slapd)

   LAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
   

5. Create tls configuration file (tls-config.ldif):

   dn: cn=config
   add: olcTLSCACertificateFile
   olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem
   -
   add: olcTLSCertificateFile
   olcTLSCertificateFile: /etc/ldap/ssl/ldap.dev.local-cert.pem
   -
   add: olcTLSCertificateKeyFile
   olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.dev.local-key.pem
   

6. Apply it:

   ldapmodify -QY EXTERNAL -H ldapi:/// -f tls-config.ldif
   

7. Restart slapd:

   /etc/init.d/slapd restart
   

8. Ensure started:

   netstat -tunlp | grep slapd
   tcp        0      0 0.0.0.0:636             0.0.0.0:*               LISTEN      2462/slapd      
   tcp        0      0 127.0.0.1:389           0.0.0.0:*               LISTEN      2462/slapd  
   

Client

1. Install ldap-utils package:

   apt-get install ldap-utils
   

2. Configure (file /etc/ldap/ldap.conf)

   BASE    dc=dev,dc=local
   URI     ldaps://ldap.dev.local
   
   TLS_CACERT /etc/ssl/certs/cacert.pem
   TLS_REQCERT demand
   

3. Ensure working:

   ldapsearch -x
   

4. Have a look at server log file, the communication must go through port 636 now

   ldap1 slapd[2462]: conn=1005 fd=15 ACCEPT from IP=192.168.10.8:38344 (IP=0.0.0.0:636)
   ldap1 slapd[2462]: conn=1005 fd=15 TLS established tls_ssf=128 ssf=128
   ldap1 slapd[2462]: conn=1005 op=0 BIND dn="" method=128
   ldap1 slapd[2462]: conn=1005 op=0 RESULT tag=97 err=0 text=
   ldap1 slapd[2462]: conn=1005 op=1 SRCH base="dc=dev,dc=local" scope=2 deref=0 filter="(objectClass=*)"
   ldap1 slapd[2462]: conn=1005 op=1 SEARCH RESULT tag=101 err=0 nentries=6 text=
   ldap1 slapd[2462]: conn=1005 op=2 UNBIND
   ldap1 slapd[2462]: conn=1005 fd=15 closed
   

How to create Certificates using OpenSSL

In order to create a new certificate you basically need to follow two steps: (a) create certificate request, (b) sign request by certificate authority. Since for step (b) you need certificate authority please have a look at previous post that details it.

Certificate Request

The process of creating a certificate request is the same as for certificate authority, except it is important to set valid Common Name that should be a FQDN (e.g. ldap1.dev.local) for the server that this request it for (the name that the client will access your host remotely).

ldap1:~/ca# openssl req -new -nodes -keyout newreq.pem -out newreq.pem
Generating a 2048 bit RSA private key
.....................+++
....................................+++
writing new private key to 'newreq.pem'
...
Country Name (2 letter code) [UA]:
State or Province Name (full name) [LV]:
Locality Name (eg, city) []:Lviv
Organization Name (eg, company) [XYZ Co]:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:ldap1.dev.local
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Sign Request

Here we are going to sign the client certificate request by our certificate authority:

ldap1:~/ca# /usr/lib/ssl/misc/CA.sh -sign
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem: *******
Check that the request matches the signature
Signature ok
Certificate Details:
...       
Certificate is to be certified until XXX (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Certificate:
    ...
Signed certificate is in newcert.pem

There are two important files we created: newreq.pem and newcert.pem. Consider rename those file to match the service they are created for, e.g. ldap1-key.pem and ldap1-cert.pem. You can combine them into a single file:

cat newreq.pem newcert.pem > new.pem

How to create Certificate Authority using OpenSSL

The Certificate Authority (CA) is used to verify the authenticity of a certificate. Start by installing openssl package:

apt-get install openssl

Create Private Certificate Authority

1. OpenSSL (version 0.9.8) is installed to path /usr/lib/ssl. The CA.sh script is not in search path, we are going to add it for just current session.

   export PATH=$PATH:/usr/lib/ssl/misc
   

2. Let customize a bit configuration file (/usr/lib/ssl/openssl.cnf) that is used for certificate creation, but first make a backup copy. Make the following changes:

   ...
   [ req ]
   default_bits    = 2048
   ...
   [ req_distinguished_name ]
   countryName_default             = UA
   stateOrProvinceName_default     = LV
   0.organizationName_default      = XYZ Co
   ...
   

3. Create a directory for all certificates (it can be any directory, we will create in home):

   mkdir ~/ca && cd ~/ca
   

4. Answer few questions (hit enter to create a new when prompted for CA filename):

   ldap1:~/ca# CA.sh -newca
   CA certificate filename (or enter to create)
   
   Making CA certificate ...
   Generating a 2048 bit RSA private key
   ............+++
   ........+++
   writing new private key to './demoCA/private/./cakey.pem'
   Enter PEM pass phrase: **************
   Verifying - Enter PEM pass phrase: **************
   ...
   Country Name (2 letter code) [UA]:
   State or Province Name (full name) [LV]:
   Locality Name (eg, city) []:Lviv
   Organization Name (eg, company) [XYZ Co]:
   Organizational Unit Name (eg, section) []:
   Common Name (eg, YOUR name) []:XYZ Root CA
   Email Address []:
   
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []:
   An optional company name []:
   Using configuration from /usr/lib/ssl/openssl.cnf
   Enter pass phrase for ./demoCA/private/./cakey.pem: *****
   Check that the request matches the signature
   Signature ok
   Certificate Details:
   ...
   Write out database with 1 new entries
   Data Base Updated
   

5. Secure Certificate Authority:

   chmod -R go-rwx ~/ca
   

Your Certificate Authority file is cacert.pem (it is located in ~/ca/demoCA directory).