SSL Cheat Sheet - Revision history

Admin: /* Create your own Certification Authority (CA) */

2022-06-13T16:00:12Z

Create your own Certification Authority (CA)

← Older revision		Revision as of 16:00, 13 June 2022
Line 212:		Line 212:
	'''Important notice''' Keep in mind that Firefox has it's own CA management		'''Important notice''' Keep in mind that Firefox has it's own CA management

	~~====Certificates====~~
	~~====fra01.local====~~
	~~[http://wiki.intern/download/fra01.local.wildcard.pfx Download PFX]~~

	~~====production.local====~~
	~~[http://wiki.intern/download/production.local.wildcard.pfx Download PFX]~~

	<br><br>		<br><br>

2022-06-13T15:57:22Z

Test commands

← Older revision		Revision as of 15:57, 13 June 2022
Line 436:		Line 436:

	=Test commands=		=Test commands=
	openssl s_client -showcerts -connect ~~api-test.server.com~~:~~7718~~		*Show certificate
	~~openssl s_client -showcerts -connect api-node02.server.com:7718~~		openssl s_client -showcerts -connect fqdn:443
	openssl s_client -connect ~~api-test.server.com~~:~~7718~~ -ssl3		*Show certificate
	gnutls-cli -d 5 ~~api-node02.server.com~~ -p ~~7718~~		openssl s_client -connect fqdn:443 -ssl3
	~~gnutls-cli -d 5 api-test.server.com -p 7718~~		*Show certificate
	curl -vvvvv https://api.server.com:~~7722~~		gnutls-cli -d 5 fqdn -p 443
	#Enumerate cipher suites		*Show certificate
			curl -vvvvv https://api.server.com:443
			*Enumerate cipher suites
	nmap -sV --script ssl-enum-ciphers -p 443 server.com		nmap -sV --script ssl-enum-ciphers -p 443 server.com
			*Obtain expiry
			cat /etc/ssl/certs/ca-name.pem \| openssl x509 -noout -enddate
			*Verify LDAP CA Cert with root cert
			openssl s_client -connect fqdn:636 -servername fqdn -showcerts > ca-cert.pem
			openssl verify -verbose -CAfile cacert.pem /etc/ssl/certs/ca-name.pem

	=Links=		=Links=

2022-04-11T12:51:47Z

Create a Self-Signed Certificate

← Older revision		Revision as of 12:51, 11 April 2022
Line 95:		Line 95:
	#Self Sign		#Self Sign
	openssl req -x509 -days 3000 -nodes -newkey rsa:2048 -keyout /etc/ssl/self/self.key -out /etc/ssl/self/self.crt		openssl req -x509 -days 3000 -nodes -newkey rsa:2048 -keyout /etc/ssl/self/self.key -out /etc/ssl/self/self.crt


			'''Apache configuration sample'''
			Use the self signed cert for example in your apache configuration, this way the certificate would be used as default
			<VirtualHost _default_:443>
			DocumentRoot /var/www/html
			SSLCertificateFile /etc/ssl/self/self.crt
			SSLCertificateKeyFile /etc/ssl/self/self.key
			</VirtualHost>

	==Installing the Private Key and Certificate==		==Installing the Private Key and Certificate==

2022-04-11T12:49:58Z

Create a Self-Signed Certificate

← Older revision		Revision as of 12:49, 11 April 2022
Line 78:		Line 78:

	To generate a temporary certificate which is good for 3650 days, issue the following command:		To generate a temporary certificate which is good for 3650 days, issue the following command:
			openssl genrsa -out server.com.key 2048 #Create Priv.Key
	openssl x509 -req -days 3650 -in ~~icinga.~~server.com.csr -signkey ~~icinga.~~server.com.key -out ~~icinga.~~server.com.crt		cp server.com.key server.com.key.org #Copy pric key tmp
			openssl rsa -in server.com.key.org -out server.com.key #Remove paasphrase
			openssl req -new -key server.com.key -out server.com.csr #Create CSR
			#Self Sign
			openssl x509 -req -days 3650 -in server.com.csr -signkey server.com.key -out server.com.crt
	Signature ok		Signature ok
	subject=/C=DE....		subject=/C=DE....

2022-04-11T12:47:26Z

Create a Self-Signed Certificate

← Older revision		Revision as of 12:47, 11 April 2022
Line 86:		Line 86:

	'''Alternative way without specifying a domain name'''		'''Alternative way without specifying a domain name'''
	openssl req -x509 -days 3000 -nodes -newkey rsa:2048 -keyout /etc/~~nginx~~/~~ssl~~/self.key -out /etc/~~nginx~~/~~ssl~~/self.crt		openssl genrsa -out self.key 2048 #Create Priv.Key
			cp self.key self.key.org #Copy pric key tmp
			openssl rsa -in self.key.org -out self.key #Remove paasphrase
			#Self Sign
			openssl req -x509 -days 3000 -nodes -newkey rsa:2048 -keyout /etc/ssl/self/self.key -out /etc/ssl/self/self.crt

	==Installing the Private Key and Certificate==		==Installing the Private Key and Certificate==

2022-03-17T09:15:09Z

Test commands

← Older revision		Revision as of 09:15, 17 March 2022
Line 425:		Line 425:
	gnutls-cli -d 5 api-test.server.com -p 7718		gnutls-cli -d 5 api-test.server.com -p 7718
	curl -vvvvv https://api.server.com:7722		curl -vvvvv https://api.server.com:7722
			#Enumerate cipher suites
			nmap -sV --script ssl-enum-ciphers -p 443 server.com

	=Links=		=Links=

2021-12-16T12:07:10Z

Create csr using templates

← Older revision		Revision as of 12:07, 16 December 2021
Line 412:		Line 412:

	*Konvert to pfx		*Konvert to pfx
	openssl pkcs12 -export -inkey common.server.com.key -in ~~risk2value~~.~~azure2-test~~.~~comp.db.de~~.pem -out common.server.com.pfx -name CERT		openssl pkcs12 -export -inkey common.server.com.key -in common.server.com.pem -out common.server.com.pfx -name CERT

	=Certutil=		=Certutil=

2021-11-16T16:57:51Z

Create csr using templates

← Older revision		Revision as of 16:57, 16 November 2021
Line 362:		Line 362:

	=Create csr using templates=		=Create csr using templates=
			Create a CSR using a template file, then covert for Apache or PFX

	*Gen Priv Key		*Gen Priv Key
Line 377:		Line 377:
	req_extensions = req_ext		req_extensions = req_ext
	distinguished_name = dn		distinguished_name = dn

	[dn]		[dn]
	C=US		C=US
Line 386:		Line 386:
	emailAddress = common@server.com		emailAddress = common@server.com
	CN = common.server.com		CN = common.server.com

	[req_ext]		[req_ext]
	subjectAltName = @alt_names		subjectAltName = @alt_names

2021-11-16T16:52:39Z

Test commands

← Older revision		Revision as of 16:52, 16 November 2021
Line 413:		Line 413:
	*Konvert to pfx		*Konvert to pfx
	openssl pkcs12 -export -inkey common.server.com.key -in risk2value.azure2-test.comp.db.de.pem -out common.server.com.pfx -name CERT		openssl pkcs12 -export -inkey common.server.com.key -in risk2value.azure2-test.comp.db.de.pem -out common.server.com.pfx -name CERT

			=Certutil=
			Use certutil to import a pfx certificate using the Microsoft RSA SChannel Cryptographic Provider
			certutil -csp "Microsoft RSA SChannel Cryptographic Provider" -importpfx c:\common.server.com.pfx

	=Test commands=		=Test commands=

2021-11-16T16:50:05Z

Letsencrypt

← Older revision		Revision as of 16:50, 16 November 2021
Line 358:		Line 358:

	<br><br><br>		<br><br><br>



			=Create csr using templates=


			*Gen Priv Key
			openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out common.server.com.key -aes-256-cbc -pass pass:secretstring


			*Create File: common.server.com.req

			[req]
			default_bits = 3072
			extendedKeyUsage = serverAuth
			prompt = no
			default_md = sha256
			req_extensions = req_ext
			distinguished_name = dn

			[dn]
			C=US
			ST = Nevada
			L = Las Vegas
			O = MGM
			OU = Grand
			emailAddress = common@server.com
			CN = common.server.com

			[req_ext]
			subjectAltName = @alt_names
			[alt_names]
			DNS.0 = common.server.com
			DNS.1 = www.common.server.com


			*Create CSR
			openssl req -batch -new -key common.server.com.key -config common.server.com.req -extensions req_ext -out common.server.com.csr -passin pass:secret

			*View to check
			openssl req -noout -text -in common.server.com.csr

			*Optional Remove Pwd
			openssl rsa -in common.server.com.key -out common.server.com.key_v2

			*Send CSR and wait for the Cert (common.server.com.cer)

			*Convert to PEM
			openssl x509 -inform der -in common.server.com.cer -out common.server.com.pem

			*Display information
			openssl x509 -in common.server.com.pem -text -noout

			*Konvert to pfx
			openssl pkcs12 -export -inkey common.server.com.key -in risk2value.azure2-test.comp.db.de.pem -out common.server.com.pfx -name CERT

	=Test commands=		=Test commands=