Consejos y trucos para GNU/Linux: Creación de un certificado firmado por uno mismo

Empezamos con una serie de guías, tutoriales, trucos y consejos para que todos los usuarios de GNU/Linux puedan ir probando cosas nuevas y útiles.

En la entrega de hoy vamos a ver cómo crear un certificado firmado por nosotros mismos, en este caso el uso que le vamos a dar es para poder establecer una conexión segura con mi irc.

Primeros Pasos:
Preparación de los directorios.

[ircadmin@jmr conf]$ pwd
/home/ircadmin/conf
[ircadmin@jmr conf]$ mkdir cert
[ircadmin@jmr conf]$

Importante que tengan permiso 700 para su correcta protección..

Comandos a Utilizar:
Vamos a generar la llave privada del servidor, en este caso para apache no necesita que se introduzca el password para su inicio. Tener en cuenta que nos pedirá protegerlo con una password lo suficientemente poderosa para evitar problemas.

[ircadmin@jmr cert]$ openssl genrsa -des3 -out server.key 4096
Generating RSA private key, 4096 bit long modulus
......................................................................++
..................................................................................................................................................................++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
[ircadmin@jmr cert]$


Creación de la solicitud de firma de certificado
En este paso vamos a crear la solicitud de firma de certificado con la clave que hemos creado antes, utilizando el archivo creado anteriormente.
Vamos a tener que poner algunos datos para demostrar que somos los que decimos, esto no valida nada dado que no estamos aprobados por ningún centro de autorización internacional o avalado.


[ircadmin@jmr cert]$ openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:AR
State or Province Name (full name) [Berkshire]:BSAS
Locality Name (eg, city) [Newbury]:CAMPANA
Organization Name (eg, company) [My Company Ltd]:ITRESTAURACION
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:irc.restauradordeleyes.com.ar
Email Address []:villadalmine@fedoraproject.org

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[ircadmin@jmr cert]$


Firmar mi certificado:
Vamos ahora a firmar nuestro certificado. Podemos elegir la cantidad de días que va a durar.

[ircadmin@jmr cert]$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=AR/ST=BSAS/L=CAMPANA/O=ITRESTAURACION/CN=irc.restauradordeleyes.com.ar/emailAddress=villadalmine@fedoraproject.org
Getting Private key
Enter pass phrase for server.key:
[ircadmin@jmr cert]$


Para obtener la huella y mas info.


[ircadmin@jmr cert]$ openssl x509 -noout -fingerprint -text < server.crt
SHA1 Fingerprint=63:B9:D0:DA:50:B6:2A:89:94:6B:6F:1F:9B:15:59:F9:B0:6E:39:25
Certificate:
Data:
Version: 1 (0x0)
Serial Number:
d0:48:16:14:75:12:5b:60
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=AR, ST=BSAS, L=CAMPANA, O=ITRESTAURACION, CN=irc.restauradordeleyes.com.ar/emailAddress=villadalmine@fedoraproject.org
Validity
Not Before: Feb 26 22:09:54 2012 GMT
Not After : Feb 25 22:09:54 2013 GMT
Subject: C=AR, ST=BSAS, L=CAMPANA, O=ITRESTAURACION, CN=irc.restauradordeleyes.com.ar/emailAddress=villadalmine@fedoraproject.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (4096 bit)
Modulus (4096 bit):
00:9d:0b:dd:6e:58:a9:bc:03:98:db:db:9c:bf:81:
b8:f7:0f:9d:0c:11:25:3c:70:d3:35:ff:65:f3:99:
9a:f5:44:95:4c:25:7c:0e:65:a8:22:38:14:3e:1d:
08:01:76:18:0a:9f:b7:28:5c:b9:1a:96:d3:3a:44:
87:90:40:f2:f0:b4:7f:46:ea:68:62:b0:13:ae:c2:
7f:94:92:6f:01:ce:ac:b2:4a:33:0a:58:fc:6d:c4:
86:33:d5:c4:1d:ff:c8:bb:68:0f:b6:0d:85:ab:08:
53:ca:3f:f0:fa:28:c0:5e:7c:87:a6:7d:7c:46:0d:
c2:e4:b9:83:4e:37:52:d6:b7:5d:7a:c5:51:f9:dc:
2e:88:11:55:6b:34:30:de:27:16:6d:f5:9e:e7:76:
40:24:ef:8e:67:59:78:e9:c8:21:ae:c9:a4:b8:85:
8e:f0:18:10:79:13:0e:ee:4f:c7:a0:72:0b:84:39:
5e:d1:8a:a1:d3:4c:19:42:35:1a:17:3e:a7:8d:80:
30:1a:29:ab:0e:40:e2:b4:4b:8b:4a:85:ab:8f:41:
1b:fe:a6:be:b4:90:31:f2:3d:9f:e7:72:88:32:9e:
bd:43:47:38:59:e3:06:2a:3f:7f:3a:a2:ed:68:2b:
db:6e:20:95:34:e3:2b:74:6e:a2:d4:12:7a:5e:00:
26:4b:5c:9f:85:96:3c:bc:19:fe:43:2c:85:b4:c4:
82:69:04:9c:63:6d:ff:6a:40:9a:c3:7c:8e:a7:44:
f8:0e:45:a9:44:cf:d6:d1:ad:e9:ee:4f:9e:72:ba:
22:2b:91:c7:0f:68:04:f2:08:f9:77:e9:cf:af:56:
43:a6:ee:17:15:e5:98:e4:44:42:8d:b9:13:ce:0c:
6f:1e:17:bd:20:47:a5:b1:54:39:6e:d7:18:c2:21:
e2:7d:d6:73:71:dc:45:e6:9b:68:15:a7:82:e7:03:
95:d1:6e:5f:2c:00:0e:60:de:3d:13:d2:66:7d:f3:
88:c2:25:96:a0:31:56:75:1b:70:af:03:31:8e:ec:
b3:c0:fb:8d:05:9c:1c:b1:b8:92:d7:5b:36:4a:1c:
99:1e:54:67:f9:7c:a6:d3:35:c8:ed:42:3a:bc:8c:
88:d3:5f:ef:21:01:98:e8:9b:66:32:62:e7:1f:79:
e6:ae:0c:76:85:23:b4:f2:11:61:31:9e:a0:88:d1:
65:9d:74:ba:8e:21:6e:f3:b6:b5:42:f9:2c:8d:cb:
2c:23:47:f8:bd:74:01:fd:e3:39:2d:b3:51:b9:6a:
6c:53:27:d0:26:33:fd:93:57:18:79:f5:12:1a:5b:
b2:fc:c9:6f:c0:17:96:e4:3e:cd:59:1e:60:1a:5e:
76:60:bb
Exponent: 65537 (0x10001)
Signature Algorithm: sha1WithRSAEncryption
0b:98:75:da:67:f0:7d:84:67:d9:e2:3d:a1:a0:57:3e:5e:32:
c1:c1:f2:92:b5:dc:52:c6:19:71:6e:be:fa:a3:fb:39:b7:33:
24:30:47:95:5f:ae:51:f9:7d:92:48:f1:3e:4c:93:87:15:45:
f2:db:1a:04:13:4e:ea:9c:cd:d0:af:6f:97:84:fb:e5:14:1e:
2d:eb:1c:09:86:a9:7b:75:fa:d4:90:95:a7:e1:62:88:c6:7b:
18:c7:29:0d:73:e1:a6:cd:eb:17:ff:0b:3e:3e:02:85:69:4a:
33:ad:59:3d:48:6a:73:1e:bd:a2:2c:fb:70:e6:22:47:43:03:
23:8b:de:d5:8b:e7:69:60:76:46:47:aa:a8:0b:af:0d:74:54:
da:45:1c:7b:5e:45:4d:0c:40:68:5b:7d:7e:10:d6:4b:a5:42:
22:b5:ef:9f:2b:18:f5:7b:99:2a:36:d2:e5:6b:5e:4e:3f:4d:
99:19:99:a3:19:b8:1c:27:a4:60:0d:60:18:7d:4e:71:f4:cd:
2c:19:31:df:2f:50:93:92:8b:75:b3:18:8b:b6:84:d3:4b:ef:
3b:63:32:fa:9a:47:3a:0e:2e:ea:10:29:8e:d9:a2:e9:11:e3:
2e:77:9f:93:da:b3:7c:90:fd:67:f7:a4:c8:8e:75:6c:2b:83:
da:d3:89:8a:f7:43:07:da:1a:01:8d:7d:40:c2:30:3f:48:a4:
0e:36:2d:78:43:8c:17:7e:2d:e9:47:98:f0:77:33:53:bf:88:
d3:71:88:5a:1e:65:2f:88:25:01:84:fa:d1:ad:4a:24:63:70:
ee:31:1a:5b:25:52:39:a4:b8:5c:cc:df:cd:7c:1c:39:80:f6:
65:b1:85:01:5e:a4:4e:6b:59:9c:db:34:9b:d7:b7:56:64:70:
23:8a:93:6e:06:5a:01:54:26:95:9d:26:45:f8:96:56:c3:e2:
9f:6d:a0:a6:42:4b:41:94:19:75:d8:d7:e5:fc:64:43:0e:8c:
1c:f0:28:85:f6:2a:f7:f1:23:14:64:1b:28:ad:9c:ae:29:e4:
ee:3a:79:6e:83:df:e1:b6:8c:e9:d5:5b:1b:14:22:b0:cf:5b:
ee:39:26:f9:03:30:5b:e6:8e:47:59:de:79:af:a8:1e:fc:6b:
75:e1:43:fc:5f:1e:50:32:8b:e6:e3:8d:dd:82:0a:5c:99:56:
72:bd:d5:1d:27:00:bb:54:b9:1e:62:9c:66:cc:8a:c3:cc:ae:
bb:19:e7:43:fa:cd:3c:62:58:c8:db:ba:8f:76:92:a4:fb:38:
c3:4e:48:c9:b2:2d:1b:e2:cd:9e:59:3d:12:04:20:6d:cf:57:
f7:0d:b6:59:0a:02:ac:a4
[ircadmin@jmr cert]$


Configurnado nuestro unrealirc:
En el archivo de configuración del irc agregamos la siguiente linea para que busque los certificados.

set {
ssl {
certificate server.crt;
key server.key;
trusted-ca-file server.crt;
};
};


Ahora vamos a parar e iniciar nuevamente nuestro servicio irc y vamos a tener que poner la clave de nuestro certificado.

[ircadmin@jmr conf]$ ./unreal stop
Stopping UnrealIRCd
[ircadmin@jmr conf]$ ./unreal start
Starting UnrealIRCd
_ _ _ ___________ _____ _
| | | | | |_ _| ___ \/ __ \ | |
| | | |_ __ _ __ ___ __ _| | | | | |_/ /| / \/ __| |
| | | | '_ \| '__/ _ \/ _` | | | | | / | | / _` |
| |_| | | | | | | __/ (_| | |_| |_| |\ \ | \__/\ (_| |
\___/|_| |_|_| \___|\__,_|_|\___/\_| \_| \____/\__,_|
v3.2.8.1
using TRE 0.7.5 (LGPL)
using OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
using zlib 1.2.3

* Loading IRCd configuration ..
* Configuration loaded without any problems ..
* Loading tunefile..
* Initializing SSL.
Password for SSL private key:
* Dynamic configuration initialized .. booting IRCd.
---------------------------------------------------------------------
[ircadmin@jmr conf]$


Una vez que esta todo completado vamos a configurar nuestro cliente pidgin para que se conecte al servidor irc en el puerto 6697.
Veamos las siguientes fotos.

Vamos a ver que pasa cuando nos conectamos, dado que nos va a pedir que aceptemos el certificado como si se tratara de una pagina web con https.

Si quisieramos ver el certficado.

A continuación vamos a ver como se genera la conexion una vez que aceptamos el certificado.

Bibliografía:
http://www.madboa.com/geek/openssl/
http://webdesign.about.com/od/ssl/ht/new_selfsigned.htm
http://forums.gentoo.org/viewtopic-p-3376064.html
http://forums.unrealircd.com/viewtopic.php?f=3&t=7352
http://www.unrealircd.com/files/docs/unreal32docs.es.html