SSL

openssl certificate + key generation

   1 openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/http2.pem -keyout /etc/ssl/private/http2.pem
   2 #Country Name: PT
   3 #Country Name (2 letter code) [XX]:PT
   4 #State or Province Name (full name) []:State
   5 #Locality Name (eg, city) [Default City]:City
   6 #Organization Name (eg, company) [Default Company Ltd]:example
   7 #Organizational Unit Name (eg, section) []:
   8 #Common Name (eg, your name or your server's hostname) []:*.example.org
   9 #Email Address []:user@example.org
  10

Check https connection

   1 openssl s_client -connect wiki.bitarus.allowed.org:443

Multiple SSL nginx

http://nginx.org/en/docs/http/configuring_https_servers.html

Multiple SSL Apache

https://wiki.apache.org/httpd/NameBasedSSLVHosts

As a rule, it is impossible to host more than one SSL virtual host on the same IP address and port.

It is acceptable to use a single SSL configuration for several virtual hosts. In particular, this will work if the SSL certificate applies to all the virtual hosts. For example, this will work if:

All the VirtualHosts are within the same domain, eg: one.example.com and two.example.com. You have a wildcard SSL certificate for that domain (one where the Common Name begins with an asterix: i.e *.example.com)

Encrypt and decrypt with openssl + RSA keypair + base64

   1 # generate RSA key pair
   2 openssl genrsa -out private.pem 2048
   3 # export public key 
   4 openssl rsa -in private.pem -outform PEM -pubout -out public.pem
   5 
   6 rm test.txt test.txt.bin.enc test.txt.bin.enc.b64 decoded.enc test.txt.bin
   7 echo -n "test" > test.txt
   8 hexdump -C test.txt
   9 # encrypt with public key
  10 openssl rsautl -encrypt -inkey public.pem -pubin -in test.txt -out test.txt.bin.enc
  11 # encode 
  12 base64 test.txt.bin.enc > test.txt.bin.enc.b64
  13 # decode
  14 base64 -d test.txt.bin.enc.b64 > decoded.enc
  15 # decrypt with public key 
  16 openssl rsautl -decrypt -inkey private.pem -in decoded.enc -out test.txt.bin
  17 hexdump -C test.txt.bin

encrypt.sh

   1 # ssh-keygen
   2 # openssl rsa -in id_rsa -outform PEM -pubout -out id_rsa.pub.pem
   3 MESSAGE=message.txt
   4 MESSAGE_ENC=message.txt.enc
   5 MESSAGE_ENC_B64=message.txt.enc.b64
   6 PUB_KEY=~/.ssh/id_rsa.pub.pem
   7 
   8 echo -n $1 > $MESSAGE
   9 openssl rsautl -encrypt -inkey "$PUB_KEY" -pubin -in "$MESSAGE" -out "$MESSAGE_ENC" 
  10 base64 $MESSAGE_ENC > $MESSAGE_ENC_B64
  11 cat $MESSAGE_ENC_B64

decrypt.sh

   1 OUT_MESSAGE=message.txt.dec
   2 MESSAGE_ENC_B64=message.txt.enc.b64
   3 DECODED_ENC=message.dec.enc
   4 PRV_KEY=~/.ssh/id_rsa
   5  
   6 base64 -d $MESSAGE_ENC_B64 > $DECODED_ENC
   7 openssl rsautl -decrypt -inkey $PRV_KEY -in $DECODED_ENC -out $OUT_MESSAGE
   8 cat $OUT_MESSAGE

Asymmetric RSA 4096 bit, sign , encrypt, decrypt and check signature

   1 # create message
   2 cd /tmp
   3 echo "Hello world" > original.txt
   4 
   5 # create keys
   6 openssl genpkey -algorithm RSA -out private.pem -pkeyopt rsa_keygen_bits:4096
   7 openssl rsa -pubout -in private.pem -out public.pem
   8 
   9 # sign and encrypt 
  10 openssl pkeyutl -sign -inkey private.pem -in original.txt | base64 > signature.sig
  11 openssl pkeyutl -encrypt -pubin -inkey public.pem -in original.txt | base64 > encrypted.enc
  12 
  13 # decrypt 
  14 base64 -d encrypted.enc | openssl pkeyutl -decrypt -inkey private.pem -out received.txt
  15 
  16 # check signature
  17 base64 -d signature.sig > signature.bin
  18 openssl pkeyutl -verify -pubin -inkey public.pem -sigfile signature.bin -in received.txt
  19 rm signature.bin

https://gethttpsforfree.com/

   1 cd ~
   2 openssl genrsa 4096 > httpsforfreeaccount.key
   3 openssl rsa -in httpsforfreeaccount.key -pubout > httpsforfreeaccount.pub
   4 openssl genrsa 4096 > domain.key
   5 openssl req -new -sha256 -key domain.key -subj "/" \
   6   -reqexts SAN -config <(cat /etc/ssl/openssl.cnf \
   7   <(printf "\n[SAN]\nsubjectAltName=DNS:foo.com,DNS:www.foo.com"))

Get expiration date

   1 echo | openssl s_client -servername www.bitarus.allowed.org -connect www.bitarus.allowed.org:443 2>/dev/null | openssl x509 -noout -enddate

   1 import sys
   2 import os
   3 import time
   4 
   5 hostname = "www.bitarus.allowed.org"
   6 output_file = "/tmp/cert_info_%s.txt"%(hostname)
   7 command = "echo | openssl s_client -servername %s -connect %s:443 2>/dev/null | openssl x509 -noout -enddate > %s"
   8 
   9 threshold = 86400 * 5 # 5 days
  10 
  11 os.system(command%(hostname, hostname, output_file))
  12 
  13 with open(output_file) as f:
  14   for line in f:
  15     datex = line.split("=")[1].strip()
  16     print datex
  17     t = time.strptime(datex,'%b %d %H:%M:%S %Y %Z')
  18     delta = time.mktime(t) - time.time()
  19     if delta < 0: print "Expired %s"%(hostname)
  20     if delta >=0 and delta <= threshold: print "Will expire soon %s"%(hostname)
  21     if delta > threshold : print "Is okay %s"%(hostname)

Create root CA (certification authority) and signed certificate for darkstar host

   1 mkdir ~/certs
   2 cd ~/certs
   3 # create root CA private key
   4 openssl genrsa -des3 -out localCA.key 2048
   5 # create root CA certificate
   6 openssl req -x509 -new -nodes -key localCA.key -sha256 -days 1825 -out localCA.pem 
   7 # update certificates in the OS
   8 sudo cp ~/certs/localCA.pem /usr/local/share/ca-certificates/localCA.crt
   9 sudo update-ca-certificates
  10 # create darkstar host private key 
  11 openssl genrsa -out darkstar.key 2048
  12 # Create darkstar host CSR (certificate signing request)
  13 openssl req -new -key darkstar.key -out darkstar.csr

Create darkstar host configuration file called darkstar.ext

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = darkstar

   1 # Create darkstar host signed certificate 
   2 openssl x509 -req -in darkstar.csr -CA ~/certs/localCA.pem -CAkey ~/certs/localCA.key -CAcreateserial -days 825 -sha256 -extfile darkstar.ext -out darkstar.crt 
   3 
   4 cd /etc/nginx/sites-available
   5 nano darkstar
   6 ssl_certificate /etc/ssl/certs/darkstar.crt;
   7 ssl_certificate_key /etc/ssl/private/darkstar.key;
   8 
   9 sudo mv darkstar.crt /etc/ssl/certs
  10 sudo mv darkstar.key /etc/ssl/private/
  11 service nginx restart

Import the root CA in the certificates authorities part in the browsers.

Firefox
- settings, privacy and security
- view certificates
- Authorities, import
- import localCA.pem
- trust to identify websites and email users
- Access https://darkstar/
Android Chrome
- Install root CA certificate from https://darkstar/localCA.crt
  - VPN and apps
  - cert name "localCA root cert"

Create root CA for debian elitedesk

   1 # elitedesk localCA 
   2 sudo apt install nginx 
   3 mkdir ~/certs
   4 cd ~/certs
   5 # create root CA private key
   6 openssl genrsa -des3 -out localCA.key 2048
   7 # PEM pass phrase 
   8 
   9 # create root CA certificate
  10 openssl req -x509 -new -nodes -key localCA.key -sha256 -days 3650 -out localCA.pem  -subj "/C=PT/ST=Setubal/L=Corroios/O=Bitarus/OU=Dev/CN=localCA"
  11 # PEM pass: 
  12 
  13 # update certificates in the OS
  14 ls /usr/local/share/ca-certificates/
  15 sudo cp ~/certs/localCA.pem /usr/local/share/ca-certificates/localCA.crt
  16 sudo update-ca-certificates
  17 # create elitedesk host private key 
  18 openssl genrsa -out elitedesk.key 2048
  19 # Create elitedesk host CSR (certificate signing request)
  20 openssl req -new -key elitedesk.key -out elitedesk.csr -subj "/C=PT/ST=Setubal/L=Corroios/O=Bitarus/OU=Dev/CN=elitedesk"
  21 nano elitedesk.ext

   1 authorityKeyIdentifier=keyid,issuer
   2 basicConstraints=CA:FALSE
   3 keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   4 subjectAltName = @alt_names
   5 
   6 [alt_names]
   7 DNS.1 = elitedesk
   8 DNS.2 = elitedesk.intra.bitarus.org

   1 # sign CSR with localCA
   2 openssl x509 -req -in elitedesk.csr -CA ~/certs/localCA.pem -CAkey ~/certs/localCA.key -CAcreateserial -days 3650 -sha256 -extfile elitedesk.ext -out elitedesk.crt 
   3 # Enter pass phrase for /home/vitor/certs/localCA.key: 
   4 
   5 cd /etc/nginx/sites-available
   6 nano elitedesk

   1 server {
   2         listen 443 ssl;
   3         root /var/www/html;
   4         index index.html index.htm index.nginx-debian.html;
   5         server_name elitedesk;
   6         location / {
   7                 try_files $uri $uri/ =404;
   8         }
   9         ssl_certificate /etc/ssl/certs/elitedesk.crt;
  10         ssl_certificate_key /etc/ssl/private/elitedesk.key;
  11 }

   1 # stop k3s if required due to traefik conflicts
   2 systemctl stop k3s.service
   3 systemctl status k3s.service
   4 systemctl disable k3s.service
   5 
   6 cd ~/certs
   7 sudo mv elitedesk.crt /etc/ssl/certs
   8 sudo mv elitedesk.key /etc/ssl/private/
   9 cd /etc/nginx/sites-enabled
  10 sudo ln -s /etc/nginx/sites-available/elitedesk elitedesk
  11 sudo service nginx restart 
  12 curl http://elitedesk/ -v

Firefox

settings, privacy and security
- view certificates
- Authorities, import
- import localCA.pem
- trust to identify websites and email users
- Access https://elitedesk/ https://elitedesk.intra.bitarus.org/

Android Chrome

Install root CA certificate from localCA.pem
- VPN and apps
- cert name "localCA root cert"

Chromium settings

privacy and security,
security
manage certificates
custom,
installed by you
trusted certificates
import localCA.pem
https://elitedesk/
https://elitedesk.intra.bitarus.org/