{"id":85822,"date":"2020-06-19T13:42:20","date_gmt":"2020-06-19T11:42:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-3"},"modified":"2020-06-19T13:42:20","modified_gmt":"2020-06-19T11:42:20","slug":"opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-3","title":{"rendered":"Experience in using the RUTOKEN technology for user registration and authentication in the system (part 3)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Good day!<\/p>\n

In the previous part<\/a><\/noindex> we successfully created our own certification authority. How can it be useful for our purposes? <\/p>\n

With the help of a local certification authority, we can issue certificates and also verify signatures using these certificates.
\n<\/a><\/noindex>
\nWhen issuing a certificate to a user, the certification authority uses a special certificate issuance request Pkcs#10, which has the file format '.csr'. This request contains an encoded sequence that the certification authority knows how to correctly parse. The request includes both the user's public key and the data for creating the certificate (an associative array with user data). <\/p>\n

We will discuss how to obtain a certificate issuance request in the next article, but in this one, I want to present the main commands of the certification authority that will help us accomplish our task on the backend. <\/p>\n

So, first we need to create a certificate. For this, we use the command:<\/p>\n

openssl ca -batch -in user.csr -out user.crt<\/code><\/pre>\n
\nca \u2014 the openSSL command that relates to the certification authority,
\n-batch \u2014 disables confirmation prompts when generating the certificate.
\nuser.csr \u2014 the request for certificate creation (file in .csr format).
\nuser.crt \u2014 the certificate (the result of the command).<\/p>\n
For this command to work, the certification authority must be configured exactly as described in the previous part of the article<\/a><\/noindex>. Otherwise, you will need to specify the location of the root certification authority certificate. <\/p>\n
Certificate verification command:<\/p>\n
openssl cms -verify -in authenticate.cms -inform PEM -CAfile \/Users\/\u2026\u2026\/demoCA\/ca.crt -out data.file<\/code><\/pre>\n
\ncms \u2014 the openSSL command used for signing, verifying, encrypting data, and other cryptographic operations with openSSL.<\/p>\n
-verify \u2014 in this case, we are performing certificate verification.<\/p>\n
authenticate.cms \u2014 the file containing the signed data by the certificate issued by the previous command.<\/p>\n
-inform PEM \u2014 using the PEM format.<\/p>\n
-CAfile \/Users\/\u2026\u2026\/demoCA\/ca.crt \u2014 the path to the root certificate. (without this, my command did not work, even though paths to ca.crt are specified in openssl.cfg)<\/p>\n
-out data.file \u2014 sending the decrypted data to the file data.file.<\/p>\n
The algorithm for applying the certificate authority on the backend is as follows:<\/p>\n