Enabling OpenSSL Authentication of Users by Creating a Self-Signed Web Certificate (CTPView Server Menu)

Until CTPView Release 7.1, an existing security protocol called NSS is used for authentication of user login through the CTPView GUI. Starting with CTPView Release 7.2R1, the CTPView GUI user login authentication is implemented through OpenSSL instead of NSS. Authentication of users logging in to the CTPView GUI using OpenSSL enables secure and protected transfer of information, and also compliance with OpenSSL as validated by Federal Information Processing Standards (FIPS) 140-2.

Note:

Starting CTPView Release 9.1R5, you can use Open SSL 3.0 which validates the FIPS 140-2 certificate.

Before you begin, log in to the CTPView server and access the CTPView Configuration Menu. See Accessing the CTPView Server Configuration Menu (CTPView Server Menu).

A new CA certificate is needed to support this feature. All logging in of users using CTPView uses this new CA certificate. For this feature, Mod_ssl “mod_ssl-2.2.31-1.el5” and OpenSSL “openssl-1.0.2d-1” libraries are required. A certificate authority (CA) database is created on the CTPView server with this feature. This database is required for the OpenSSL tool to manage certificates and its path is “/etc/httpd/CA”. OpenSSL CA certificate, server certificates, certificate revocation lists (CRLs), and private keys are stored in the CA database directory.

The following configuration files are modified to support this feature:

Openssl.cnf—The following entries are enhanced in the openssl.cnf file for CA certificate management:

dir—CA database path certificate—CA certificate

private_key—CA private key

crl—CRL Path
Along with the preceding modifications, “countryName” and “stateOrProvinceName” are modified to support generation of server certificates for multiple countries and states. The nss.conf file is used by NSS protocol that uses secured web on port 443. To disable NSS protocol, all instances of the port number of 443 used in this file are replaced by 8443.
The ssl.conf file is utilized by mod_ssl library that uses secured web on port 443. To enable MOD_SSL protocol on port 443, all port numbers of 8443 used in this configuration file are replaced by 443. The SSLProtocol, SSLCertificateFile, SSLCertificateKeyFile, SSLCertificateChainFile, and SSLCACertificateFile entries in the ssl.conf file are modified.

OpenSSL Certificate Database

OpenSSL maintains a certificate database that contains CA certificate, CA private key, server certificates, server private key, Certificate Revocation List (CRL) files, serial and index file. The OpenSSL certificate database is stored in the “/etc/httpd/CA” directory. The OpenSSL certificate database directory contains following entities:

certs—This directory contains all OpenSSL certificates.
crl—This directory contains all OpenSSL CRLs.
currCert—This directory contain current installed server certificate.
index.txt—The index file consists index of all certificates.
newcerts—This directory is used by OpenSSL to create new certificates.
private—This directory contains private keys.
revokedCert—This directory contains all revoked certificates.
serial—This file is used for OpenSSL that contain the next available serial number of certificate in hexadecimal format.
crlnumber—This file is used for OpenSSL that contain the next available serial number of CRL in hexadecimal format.

The OpenSSL authentication for user login feature is not supported with user interface for CRL. Instead, CRL is managed by OpenSSL CA database.

This procedure describes the steps to create a CSR, self-sign the CSR, and import it.

To enable OpenSSL method of authentication for logging in of users by creating a self-signed Web certificate:

From the CTPView Configuration Menu, select 9) AAA Functions.
The AAA functions for CTPView can be viewed and set in the AAA sub-menu of the CLI menu script. Only System Administrators have authorization to view or modify the AAA functions. Configuration of the CTPView AAA functions has three major components:
- Configuring the global configuration parameters, for example entering the IP addresses of the RADIUS servers you want to use for authentication.
- Configuring the global configuration parameters, for example entering the IP addresses of the TACACS+ servers you want to use for authentication.
- Then selecting the options which the various access methods will use. For example, enabling HTTPS – CAC/PKI with OCSP certificate validation.
Select 7) CAC/PKI Configuration.
This selection enables you to perform CAC/PKI configuration (HTTPS). CTPView is built with a default server certificate installed which is sufficient for testing purposes only. Before deploying the server in a production environment you must obtain and install a server certificate issued by a Trusted Signing CA. If you attempt to access multiple CTPView servers running on CentOS which are still using their default self-signed certificates you may be denied access by your browser because it will detect that multiple servers are presenting certificates with the same serial number. Obtaining and installing a signed server certificate is a simple process. First, you must create a certificate signing request (CSR) for your server which you will present to the Trusted Signing CA you have selected to use. To start, go to the CAC/PKI Configuration menu. The path is menu > AAA Functions > CAC/PKI Configuration.

In the CAC/PKI Menu, select 1) Create CSR. You need to enter information about your server and organization. You are required to enter the Encryption Key Size, Common Name, Organization Name and Country. You may also include any combination of these optional fields: Organizational Unit (3 possible fields), State, and City/Town.

Follow the onscreen instructions and configure the options as described inTable 1.

Table 1: Creating a Certificate Signed Request
Field	Function	Your Action
Enter encryption key size(1024 or 2048)(Only <ENTER> to abort):	Specifies the encryption key size of the CSR file.	Specify `1024` or `2048`. If you enter a different value, you are prompted to enter the key size again. You can press `Enter` to terminate the process of creating the CSR.
Enter Common Name, i.e. IP or FQDN (Only <ENTER> to abort):	Specifies the common name to be used for the CSR file.	Specify the IP address or the fully-qualified domain name, which is the common name that is used in the distinguished name. The FQDN or any other CN values must be specified during the certificate request procedure. You can press `Enter` to terminate the process of creating the CSR.
Enter Organization Name (Only <ENTER> to abort):	Specifies the organization name of the CSR.	Enter the organization name to be used in the CSR. This name is a component in the distinguished name. You can press `Enter` to terminate the process of creating the CSR.
Enter Organizational Unit Name #1 (optional):	Specifies the first name of the organizational unit to be used in the CSR file.	Specify the first name of the organizational unit to be used in the CSR. This name is a component in the distinguished name.
Enter Organizational Unit Name #2 (optional):	Specifies the second name of the organizational unit to be used in the CSR file.	Specify the second name of the organizational unit to be used in the CSR. This name is a component in the distinguished name. This field is optional. If you not want to specify this value, press `Enter` to skip this entry and proceed to the next field.
Enter Organizational Unit Name #3 (optional):	Specifies the third name of the organizational unit to be used in the CSR file.	Specify the third name of the organizational unit to be used in the CSR. This name is a component in the distinguished name. This field is optional. If you not want to specify this value, press `Enter` to skip this entry and proceed to the next field.
Enter Country (2 characters):	Specifies the country code, such as IN for India or US for United States of America, to be used in the CSR.	Specify the country code to be used in the CSR. The country code is a parameter in the distinguished name. This field is optional. If you not want to specify this value, press `Enter` to skip this entry and proceed to the next field.
Enter State (optional):	Specifies the name of the state to be used in the CSR.	Specify the name of the state to be used in the CSR. This name is a component in the distinguished name. This field is optional. If you not want to specify this value, press `Enter` to skip this entry and proceed to the next field.
Enter City/Town (optional):	Specifies the name of the town or city to be used in the CSR.	Specify the name of the town or city to be used in the CSR. This name is a component in the distinguished name. This field is optional. If you not want to specify this value, press `Enter` to skip this entry and proceed to the next field.
CSR Filename	The script will generate a random seed to use when creating the CSR by using the timing of keystrokes on your keyboard. The CSR will be a RSA certificate in ASCII format (i.e. plain text), using either 1024 or 2048 bit encryption depending on your choice when creating the CSR. The CSR name will be <Common Name>.csr and is created in the /tmp directory on the server. If you want to change any of the information you entered when creating the CSR simply create a new CSR. Creating a CSR has no effect on the configuration or operation of the server.	View the CSR filename that is generated is displayed. You are alerted that the CSR needs to be signed by a CA. Also, the path in which the CSR file is stored is displayed.

Press Enter to continue to the next step. You need to self-sign the CSR after you have created it. The CAC/PKI menu is displayed.
In the CAC/PKI Menu, select 2) Self-Sign CSR.
While it is preferred that you have your server CSR signed by a Trusted Signing CA, where that is not possible you may generate a self-signed server certificate using the CTPView_CA issued by Juniper Networks. Note that if you use the CTPView_CA certificate, the self-signed certificate will generate an error in client browsers to the effect that the signing certificate authority is unknown and not trusted. However you will be able to successfully complete the connection. To use the CTPView_CA to sign your CSR select Self-Sign CSR from the CAC/PKI Menu.

Enter the CSR filename and the utility will create a signed server certificate which you can then import into the certificate database. No additional Chain of Trust certificates are required to use the CTPView_CA. As when creating a CSR, repeating the signing process has no effect on the configuration or operation of the server since a separate process is required to import the certificate. When the Trusted Signing CA sends you the signed server certificate you will need to import it into your server’s certificate database. You will also need to import all of the certificates that make up the Chain of Trust for your new server certificate. These are available from your Trusted Signing CA. Copy all of the certificates into the /tmp directory of the server. They can have any filename and file extension.
Enter answers for each question that is subsequently displayed.
You are required to enter the Encryption Key Size, Common Name, Organization Name and Country. You may also include any combination of these optional fields: Organizational Unit (3 possible fields), State, and City/Town. The script will generate a random seed to use when creating the CSR by using the timing of keystrokes on your keyboard. The CSR will be a RSA certificate in ASCII format (i.e. plain text), using either 1024 or 2048 bit encryption depending on your choice when creating the CSR. The CSR name will be <Common Name>.csr and is created in the /tmp directory on the server. If you want to change any of the information you entered when creating the CSR simply create a new CSR. Creating a CSR has no effect on the configuration or operation of the server. Send the CSR which you created to your Trusted Signing CA. You may be asked to send the CSR as an email attachment or to paste the CSR into a web form. You can do that by opening the CSR file with a text editor, such as WordPad or VI, then use the copy and paste editing functions to transfer the new certificate request to the web form.

Note:
For Common Name, enter the IP address of the server. Otherwise, your users’ browsers will report a domain name mismatch when users connect to the server.

Follow the onscreen instructions and configure the options as described inTable 2.

Table 2: Self-Signing a Certificate Signed Request
Field	Function	Your Action
Enter the CSR filename (Only <ENTER> to abort):	Specify the name of the CSR file. The CSR will be a RSA certificate in ASCII format (i.e. plain text), using either 1024 or 2048 bit encryption depending on your choice when creating the CSR. The CSR name will be <Common Name>.csr and is created in the /tmp directory on the server.	Specify the name of the CSR. Press `Enter` to terminate the operation.
Enter pass phrase for /etc/httpd/alias/demoCA/private/CTPView_CA.key:	Specifies the pass phrase, after which the system checks whether the request matches with the signature.	Specify the pass phrase.
Sign the certificate? [y/n]:	Specifies whether you want to sign the certificate.	Specify `y` or `n`.
1 out of 1 certificate requests certified, commit? [y/n]	Specifies whether you want to commit the signed certificate to the database.	Specify `y` or `n`.

Press Enter to continue to the next step of importing the certificate. The CAC/PKI menu is displayed.
From the CAC/PKI Menu, select 4) Import Certificate to import the certificate into the database.
There are two categories of certificates you may import. The first is the returned CSR certificate signed by a Signing CA. The second is the group of certificates which are in the chain

Follow the onscreen instructions and configure the options as described inTable 3.

Table 3: Self-Signing a Certificate Signed Request
Field	Function	Your Action
Enter the certificate filename (Only <ENTER> to abort):	Specifies the name of the CSR. The CSR name will be <Common Name>.csr and is created in the /tmp directory on the server. If you want to change any of the information you entered when creating the CSR simply create a new CSR. Creating a CSR has no effect on the configuration or operation of the server.	Specify the name of the CSR file that you previously created. Press `Enter` to terminate the operation.
Is this the signed CSR certificate for this server? [N]	Specifies whether the signed CSR is for the server on which you are configuring it. If you enter `y`, the HTTP daemon is stopped and started. You are asked to enter the pass phrase in the next step.	Specify `y` or `n`.
Enter pass phrase:	Specifies the pass phrase for the private key files that need to be decrypted for security reasons.	Specify the pass phrase for the private key files that are encrypted.

Press Enter to continue to the next step. The CAC/PKI menu is displayed.
From the CAC/PKI Menu, select 5) Display Certificate. The list of certificates are displayed.

Enabling OpenSSL Authentication of Users by Creating a Self-Signed Web Certificate (CTPView Server Menu)

Related Documentation