Good afternoon! Let's continue to explore this topic ().
Today we will move on to the practical part. We'll start by setting up your own certification authority based on the full open-source cryptographic library openSSL. This algorithm has been tested using Windows 7.
Once openSSL is installed, we can perform various cryptographic operations (for example, creating keys and certificates) via the command line.
The steps are as follows:
- Download the openSSL installer for version openssl-1.1.1g.
There are different versions of openSSL. The documentation for Rutoken states that an openSSL version of 1.1.0 or newer is required. I used version openssl-1.1.1g. You can download openSSL from the official site, but for easier installation, you should find the installer file for Windows online. I did that for you:
You need to scroll down the page and download the Win64 OpenSSL v1.1.1g EXE 63MB Installer. - Install openssl-1.1.1g on your computer.
The installation should follow the standard path automatically specified in the C:Program Files folder. The program will be installed in the OpenSSL-Win64 folder. - To configure openSSL per your requirements, there is a file named openssl.cfg. This file is located at C:Program FilesOpenSSL-Win64bin if you installed openSSL as mentioned in the previous point. Navigate to the folder where openssl.cfg is stored and open this file using, for example, Notepad++.
- You probably guessed that the setup of the certification authority will involve modifying the contents of the openssl.cfg file, and you are absolutely right. To do this, you need to configure the [ ca ] command. In the openssl.cfg file, you can find the beginning of the text where we will make changes as: [ ca ].
- Now I will provide an example of the configuration along with its description:
[ ca ] default_ca = CA_default [ CA_default ] dir = /Users/username/bin/openSSLca/demoCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/ca.crt serial = $dir/private/serial crlnumber = $dir/crlnumber crl = $dir/crl.pem private_key = $dir/private/ca.key x509_extensions = usr_certNow it is necessary to create the demoCA directory and subdirectories as shown in the example above. Place them in the directory specified in dir (for me, it is /Users/username/bin/openSSLca/demoCA).
It is very important to correctly specify the dir – this is the path to the directory where our certification center will be located. This directory must necessarily be within /Users (that is, in the account of some user). If you place this directory, for example, in C:Program Files, the system will not see the file with the settings openssl.cfg (at least that was my experience).
$dir – here the path specified in dir is inserted.
Another important point is to create an empty index.txt file; without this file, the commands "openSSL ca ..." will not work.
You also need to have the serial file, root private key (ca.key), and root certificate (ca.crt). The process of obtaining these files will be described later.
- We connect the encryption algorithms provided by Rutoken.
This connection occurs in the openssl.cfg file.- First of all, it is necessary to download the required Rutoken algorithms. These are the files rtengine.dll, rtpkcs11ecp.dll.
To do this, we download the Rutoken SDK: .Rutoken SDK contains everything for developers who want to try out Rutoken. It includes both separate examples for working with Rutoken in different programming languages and some libraries. Our libraries rtengine.dll and rtpkcs11ecp.dll are located in the Rutoken SDK as follows:
sdk/openssl/rtengine/bin/windows-x86_64/lib/rtengine.dll
sdk/pkcs11/lib/windows-x86_64/rtpkcs11ecp.dllA very important point. The libraries rtengine.dll, rtpkcs11ecp.dll do not work without the installed driver for Rutoken. Additionally, the Rutoken must be connected to the computer. (For the installation of everything necessary for Rutoken, see the previous part of the article )
- The libraries rtengine.dll and rtpkcs11ecp.dll can be kept anywhere in the user account.
- We specify the paths to these libraries in openssl.cfg. To do this, open the openssl.cfg file and place the following line at the beginning of this file:
openssl_conf = openssl_defAt the end of the file, you need to add:
[ openssl_def ] engines = engine_section [ engine_section ] rtengine = gost_section [ gost_section ] dynamic_path = /Users/username/bin/sdk-rutoken/openssl/rtengine/bin/windows-x86_64/lib/rtengine.dll MODULE_PATH = /Users/username/bin/sdk-rutoken/pkcs11/lib/windows-x86_64/rtpkcs11ecp.dll RAND_TOKEN = pkcs11:manufacturer=AktivCo.;model=RutokenECP default_algorithms = CIPHERS, DIGEST, PKEY, RANDdynamic_path – you need to specify your path to the library rtengine.dll.
MODULE_PATH – you need to specify your path to the library rtpkcs11ecp.dll.
- First of all, it is necessary to download the required Rutoken algorithms. These are the files rtengine.dll, rtpkcs11ecp.dll.
- Add environment variables.
You must add an environment variable that specifies the path to the configuration file openssl.cfg. In my case, the variable OPENSSL_CONF was created with the path C:\Program Files\OpenSSL-Win64\bin\openssl.cfg.
The path variable must specify the path to the folder containing openssl.exe; in my case, it is: C:\Program Files\OpenSSL-Win64\bin.
- Now we can return to point 5 and create the missing files for the demoCA directory.
- The first important file without which nothing will work is serial. This file has no extension, and its value must be 01. You can create this file yourself and write 01 inside it. You can also download it from the Ruttoken SDK at sdk/openssl/rtengine/samples/tool/demoCA/.
In the demoCA directory lies the serial file, which we need. - Let's create the root private key.
To do this, we will use the openSSL library command that needs to be executed directly in the command line:openssl genpkey -algorithm gost2012_256 -pkeyopt paramset:A -out ca.key - Let's create the root certificate.
To do this, we will use the following command from the openSSL library:openssl req -utf8 -x509 -key ca.key -out ca.crtNote that creating the root certificate requires the root private key that was created in the previous step. Therefore, the command line should be run in the same directory.
Now all the missing files for the complete configuration of the demoCA directory are available. Place the created files in the directories specified in point 5.
- The first important file without which nothing will work is serial. This file has no extension, and its value must be 01. You can create this file yourself and write 01 inside it. You can also download it from the Ruttoken SDK at sdk/openssl/rtengine/samples/tool/demoCA/.
Let's consider that after completing all 8 points, our certification authority is fully configured.
In the next part, I will explain how we will work with the certification authority to achieve what was described in .
Source: habr.com
