OpenSSL

• rootCA.key = chave privada do CA
• rootCA.pem = certificado raiz CA
• device.key = chave privada do certificado
• device.csr = requisição de certificado
• device.crt = certificado do site

ca

openssl genrsa -out rootCA.key 2048
openssl genrsa -des3 -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem

cert

openssl genrsa -out device.key 2048
openssl req -new -key device.key -out device.csr
openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days 500 -sha256

Altname

• Gera Chave Privada

openssl genrsa -out iam.key 2048

• Gera CSR com base na chave privada gerada e adicionando o parâmetro de SubjectAltName

openssl req -new -sha256 -key iam.key -out iam.csr -reqexts SAN -extensions SAN -config <(cat /etc/ssl/openssl.cnf <(printf '[SAN]\nsubjectAltName=DNS:iam')

SSH

authorized_keys

Bizu de como fazer banner durante o login do chave SSH.

no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"ec2-user\" rather than the user \"root\".';echo;sleep 10" <key content here>

PFX Files

Extracting Certificate and Private Key Files from a .pfx File

• Procedure

Take the file you exported (e.g. certname.pfx) and copy it to a system where you have OpenSSL installed. Note: the *.pfx file is in PKCS#12 format and includes both the certificate and the private key.

Run the following command to export the private key: openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes
Run the following command to export the certificate: openssl pkcs12 -in certname.pfx -nokeys -out cert.pem
Run the following command to remove the passphrase from the private key: openssl rsa -in key.pem -out server.key

Creating a PFX file

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile more.crt

Displaying a remote SSL certificate details

export SITE=wiki.clusterlab.com.br
openssl s_client -showcerts -servername $SITE -connect $SITE:443

Links

• https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309
• https://stackoverflow.com/questions/7580508/getting-chrome-to-accept-self-signed-localhost-certificate/43666288#43666288