thr3ads.net - CentOS - [CentOS] https and self signed [Jun 2016]

If this information is useful, please help other people find it:
Share via:

Jerry Geis

2016-Jun-15 13:47 UTC

[CentOS] https and self signed

I followed the instructions here https://wiki.centos.org/HowTos/Https

Checking port 80 I get the file...
curl http://localhost/file.html
<HTML>
<FORM>
Working
</FORM>
</HTML>

Checking port 443 I get and error
curl https://localhost/file.html

curl: (60) Peer's certificate issuer has been marked as not trusted by the
user.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a
"bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.


How do I get past this? I was looking to just self sign for https.

Yes I can added the --insecure for curl - but - my other app doesn't
seem to work either - perhaps getting the same return message instead of
the actual file.

Thanks,

jerry

Александр Кириллов

2016-Jun-15 13:57 UTC

head link

[CentOS] https and self signed

Nowadays it's quite easy to get normal ssl certificates for free. E.g.

http://www.startssl.com
http://buy.wosign.com/free

Warren Young

2016-Jun-15 14:17 UTC

head link

[CentOS] https and self signed

On Jun 15, 2016, at 7:57 AM, ????????? ???????? <nevis2us at infoline.su>
wrote:> 
> Nowadays it's quite easy to get normal ssl certificates for free. E.g.
> 
> http://www.startssl.com
> http://buy.wosign.com/free
Today, I would prefer Let?s Encrypt:

  https://letsencrypt.org/

It is philosophically aligned with the open source software world, rather than
act as bait for a company that would prefer to sell you a cert instead.

I?m only aware of one case where you absolutely cannot use Let?s Encrypt, but it
also affects the other public CAs: you can?t get a publicly-trusted cert for a
machine without a publicly-recognized and -visible domain name.  For that, you
still need to use self-signed certs or certs signed by a private CA.

Warren Young

2016-Jun-15 14:25 UTC

head link

[CentOS] https and self signed

On Jun 15, 2016, at 7:47 AM, Jerry Geis <geisj at pagestation.com>
wrote:> 
> Yes I can added the --insecure for curl - but - my other app doesn't
> seem to work either - perhaps getting the same return message instead of
> the actual file.
Because of all the security holes people have been finding in TLS, libraries
implementing the client side of TLS are getting increasingly intolerant of risky
configurations.

It?s too bad, because self-signed certificates are only unusual on the public
Internet.  I wish the designers of TLS had included a flag in the cert that let
it declare that it was only to be trusted on a private intranet by clients of
that same intranet.

For example, instead of declaring that the given server is foo.example.com, it
would be nice if you could generate a self-signed cert that declares that it is
for 172.16.69.42, and that any host on 172.16.69.0/24 should trust it
implicitly.

Such a cert could not be used to prove identity, prevent spoofing, or prevent
MITM attacks, but it would give a way to set up encryption, which is often all
you actually want.  MITM attacks could be largely prevented with certificate
pinning.

John R Pierce

2016-Jun-15 15:10 UTC

head link

[CentOS] https and self signed

On 6/15/2016 6:47 AM, Jerry Geis wrote:> How do I get past this? I was looking to just self sign for https.
in my admittedly limited experience with this stuff, you need to create 
your own rootCA, and use that to sign your certificates, AND you need to 
take the public key of the rootCA and import it into any trust stores 
that will be used to verify said certificates.


-- 
john r pierce, recycling bits in santa cruz

John Hodrien

2016-Jun-15 15:16 UTC

head link

[CentOS] https and self signed

On Wed, 15 Jun 2016, John R Pierce wrote:
> On 6/15/2016 6:47 AM, Jerry Geis wrote:
>>  How do I get past this? I was looking to just self sign for https.
>
> in my admittedly limited experience with this stuff, you need to create
your
> own rootCA, and use that to sign your certificates, AND you need to take
the
> public key of the rootCA and import it into any trust stores that will be 
> used to verify said certificates.
If you don't do this, then there's no real point using SSL at all, and
you
*should* be forced to override security with arguments:

wget --no-check-certificate
curl --insecure

etc.

jh

Paul Heinlein

2016-Jun-15 15:37 UTC

head link

[CentOS] https and self signed

On Wed, 15 Jun 2016, John R Pierce wrote:
> On 6/15/2016 6:47 AM, Jerry Geis wrote:
>>  How do I get past this? I was looking to just self sign for https.
>
> in my admittedly limited experience with this stuff, you need to 
> create your own rootCA, and use that to sign your certificates, AND 
> you need to take the public key of the rootCA and import it into any 
> trust stores that will be used to verify said certificates.
The EasyRSA scripts make creating and using your own Certificate 
Authority as painless as X.509 can be (which is to say, there will 
still be some pain). You can find them in the OpenVPN distribution 
tarball or at GitHub:

   https://github.com/OpenVPN/easy-rsa

-- 
Paul Heinlein <> heinlein at madboa.com <> http://www.madboa.com/

Jason Pyeron

2016-Jun-15 16:36 UTC

head link

[CentOS] https and self signed

> -----Original Message-----
> From: Warren Young
> Sent: Wednesday, June 15, 2016 10:26
> To: CentOS mailing list
> Subject: Re: [CentOS] https and self signed
> 
> On Jun 15, 2016, at 7:47 AM, Jerry Geis <geisj at pagestation.com>
wrote:
> > 
> > Yes I can added the --insecure for curl - but - my other 
> app doesn't 
For the love of all that is holy, create your own CA and have your own PKI,
even for testing.
> > seem to work either - perhaps getting the same return 
> message instead 
> > of the actual file.
> 
...> It's too bad, because self-signed certificates are only 
> unusual on the public Internet.  I wish the designers of TLS 
...> self-signed cert that declares that it is for 172.16.69.42, 
> and that any host on 172.16.69.0/24 should trust it implicitly.
It is very easy to creat your own CA, to sign your own certs. There is no
need to support self signed "leaf nodes" of the PKI.

I have taken some liberties on this to save me time, you will need to change
config values to suit your needs.

$ mkdir -p CA/{private,certs}
$ cd CA
# copy the default openssl config
$ cp -v "$(openssl ca -verbose 2>&1 | head -n 1 | sed 's/Using
configuration
from //')" .
$ sed -i 's/^\(\s*dir\s*=.*\)/#\1\ndir=./'
openssl.cnf
$ sed -i 's|^\(\s*certificate\s*=.*\)|#\1\ncertificate=$dir/CA.crt|'
openssl.cnf
$ sed -i
's|^\(\s*private_key\s*=.*\)|#\1\nprivate_key=$dir/private/CA.key|'
openssl.cnf
$ sed -i
's|^\(\s*new_certs_dir\s*=.*\)|#\1\nnew_certs_dir=$dir/newcerts|'
openssl.cnf
$ touch index.txt
# done setting up the file system
$ openssl req -config openssl.cnf -new -nodes -keyout private/CA.key -out
CA.csr
# answer the questions
$ openssl ca -config openssl.cnf -batch -in CA.csr -create_serial -selfsign
# there should only be one cert, the CA's self signed cert
$ cp certs/*.pem CA.crt
# done creating the CA


# now you can sign your server certificate signing requests (CSR)

# make a csr 

#sign server.csr
$ openssl ca -config openssl.cnf -batch -in server.csr

#files at end of email for understanding...

> 
> Such a cert could not be used to prove identity, prevent 
> spoofing, or prevent MITM attacks, but it would give a way to 
> set up encryption, which is often all you actually want.  
> MITM attacks could be largely prevented with certificate pinning.
And reducing the trusted CA set in your enterprise.



$ cat ./private/CA.key
-----BEGIN PRIVATE KEY-----
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDEHcq8mOpHHD+H
/qDNPpsG2GkRyj8wt9LVIltmUqwqIBlNe3nlxHEHg9YJExPbTTXERehNkpF8HPtM
S2rfcYMz2Cjq8C8CzNlC/Ur2a8GKfOufZU9a+gv8I2CXzah6DLkdZqqCsnC/dTPL
bRLPBlmmwldl3pcOpF1hmMF1CzCwDAx2V31ZijLHlMfd+cRdssfYk1D4ntGRBK+0
78g2/nBOKQsD6ajTXHwaH7eeV7BRasjGodSud8cJ1uhD0E3QLpW466sYmM1SGdgy
1mbuJYGnfHVy4zScDy7yQb4EvoQZOYOMJymETCQfk86B43Sncs20TEpDW2N48N+O
pbqM0TAxAgMBAAECggEAIt45IXb+kE4RbZhz9one/kSTybnvqjXEomhNX8/rFEJI
vWHqtlNK1U83Sr29lgwQNylGuCQLAcoVU+dExR1lel5ASCUT9qd9KU/neBCIhJrZ
OanFhiNW5ilUDyldfvWsI/IQ9tPK//9SiiSGZ5B1eBStfUsqCExo3eVO4ARxT5tF
Fug/XgyV5vdUnUFC/axQPCWNfkFlm6mXNBcVO+D7/kweklrKLGqIFQTSv7mzL5ya
nTslER6dTu/2gva6cVAw3PN8FjgFa85ISpAWcyZ7ZBHd2evL46V1WsxFOsu5Ish+
e4SPP0xf4+8VggNvPruPb0T3gV8jHbN4fyPGqH7DwQKBgQDmbg2Mj69WN1jw1EpH
agv2xzVqTnjQSdbD2YBJ8ZJqIolAZigdrLTXp/P/pnOXe+3up1S+9OGbktQAc9DN
i9zf6Wn9NyZ323YEfL2MLE8pRrLsFFw1+fVG/BNcrHMOnt3rSQ7v2LhGe/kLCIQh
RKDSf83sEvAcfcSCpWeoZRlnxQKBgQDZ4PnrBpUVm86cq9/RV4Ax0NJ7+u+ybLj5
tKEeEDRlzTyNv2KIF7MOWoK6EMBw3N/YloSp41Zm7UXAdwjJHrxZ3GrlHvYqJDaW
cGX+GjncDpcM2GIh4tcuhnKTdUZc/eGWPZRA97EPdhqwHbDaPLSrQhtDmPDCWVNs
DqyWPFbBfQKBgH7tuEDpFOgk7LUb+x6DZ7uz19SLDTmOsuKG+IfCragRBhGXNBnE
fIkeVuVHxvx2o4WGXsQhF/UeV/E32piepjgg1uVIb8Qt+0BVhgOklKZj70LjpDeH
THihefjedTJkiFGGmNe9RSRuPay6MC4zI3NQOxoDBIhtLsXYXtT/e5MRAoGAY48t
RFsmptAikm7rgGJmftz4QZUCENsjj18dvHoVJ2uoPvF0WdHSjT2IvPNIrIoRc4wc
JPFwGupTVEZQam60DK/u3LHQNKOFmirUQE/FnqvAFCuQdAGO6IChPIZ7V6Tff2K2
KxXD/9etDEsU9DSHLjav9KyfX3+n4hm2fZQm5JUCgYB1tiDFrX4kgf671A9eMXHa
4RJKtvKdXEzw/a1uU82rvShZnlfIijHOHnOduwpFbtZRjvwREslBjwe0KXC5n4rN
ontb9cb94SmJlrYWj0ZYGbECB2nh1xBq2IeF7ly8t6Ky5xRc9hcACX5Z5G0QfHf8
liGhEmq+iGBkYtW6Jucvbg=-----END PRIVATE KEY-----

$ cat ./certs/FC4B076EEDAC665F.pem
-----BEGIN CERTIFICATE-----
MIIELjCCAxagAwIBAgIJAPxLB27trGZfMA0GCSqGSIb3DQEBCwUAMIGXMQswCQYD
VQQGEwJVUzELMAkGA1UECAwCTUQxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMg
UHR5IEx0ZDEZMBcGA1UECwwQVHJ1c3QgRGVwYXJ0bWVudDEYMBYGA1UEAwwPUHJp
dmF0ZSBSb290IENBMSMwIQYJKoZIhvcNAQkBFhRzZWN1cml0eUBleGFtcGxlLmNv
bTAeFw0xNjA2MTUxNjI3MzBaFw0xNzA2MTUxNjI3MzBaMIGXMQswCQYDVQQGEwJV
UzELMAkGA1UECAwCTUQxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0
ZDEZMBcGA1UECwwQVHJ1c3QgRGVwYXJ0bWVudDEYMBYGA1UEAwwPUHJpdmF0ZSBS
b290IENBMSMwIQYJKoZIhvcNAQkBFhRzZWN1cml0eUBleGFtcGxlLmNvbTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMQdyryY6kccP4f+oM0+mwbYaRHK
PzC30tUiW2ZSrCogGU17eeXEcQeD1gkTE9tNNcRF6E2SkXwc+0xLat9xgzPYKOrw
LwLM2UL9SvZrwYp8659lT1r6C/wjYJfNqHoMuR1mqoKycL91M8ttEs8GWabCV2Xe
lw6kXWGYwXULMLAMDHZXfVmKMseUx935xF2yx9iTUPie0ZEEr7TvyDb+cE4pCwPp
qNNcfBoft55XsFFqyMah1K53xwnW6EPQTdAulbjrqxiYzVIZ2DLWZu4lgad8dXLj
NJwPLvJBvgS+hBk5g4wnKYRMJB+TzoHjdKdyzbRMSkNbY3jw346luozRMDECAwEA
AaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0
ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFIO7y8JqSyD+EuhnoPYVNMKn0bsfMB8G
A1UdIwQYMBaAFIO7y8JqSyD+EuhnoPYVNMKn0bsfMA0GCSqGSIb3DQEBCwUAA4IB
AQBHNAQKoJ6+aToFbuDhHxBt0KBF0dJ3ZR6PbmI35zclwA7FIUWAzAfK71oBYGhT
3ALqU2Klc3CogacKD/lk18MvVLdyIKrZ7fx7gMzfmB9tqb1qRWr6AaoLRLUOXzBt
c6wHwwvKCNGyr28giQohPwa4YfdngFUI1uWr5SAeGlUoAPv23gJsN49aUu+nX6HU
lqwofRjikXtB+xlBYa3J8RYwv+Al7cCuAvWLU8coQ5NxxlfXGNzF+8kZNWcqu7xr
s6OKoO6t5rENhlIohI1Ijk0MLH5zKMgphn09m5aCiWdNu4lcfeI6lTSmpd8spGiD
vgREOnejICHw4IUIwRyqCT2g
-----END CERTIFICATE-----

$ cat ./certs/FC4B076EEDAC6660.pem
-----BEGIN CERTIFICATE-----
MIIEHzCCAwegAwIBAgIJAPxLB27trGZgMA0GCSqGSIb3DQEBCwUAMIGXMQswCQYD
VQQGEwJVUzELMAkGA1UECAwCTUQxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMg
UHR5IEx0ZDEZMBcGA1UECwwQVHJ1c3QgRGVwYXJ0bWVudDEYMBYGA1UEAwwPUHJp
dmF0ZSBSb290IENBMSMwIQYJKoZIhvcNAQkBFhRzZWN1cml0eUBleGFtcGxlLmNv
bTAeFw0xNjA2MTUxNjMwNTNaFw0xNzA2MTUxNjMwNTNaMIGIMQswCQYDVQQGEwJV
UzELMAkGA1UECAwCTUQxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0
ZDEQMA4GA1UECwwHU2VydmVyczESMBAGA1UEAwwJMTI3LjAuMC4xMSMwIQYJKoZI
hvcNAQkBFhRzZWN1cml0eUBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAMbCfmkw9xCxYOY7H51yKFsTB6A8WI1+NUqiCP7vAswXRkeh
ENKY5+hv2yUuRdbRJ9Or8bF3qaNyuWYm4xgCIN2hTwF9yk2egBvWt9gGMn7L/wTL
qTEC9M7dXDWkf0SAtIQ6H6ReQO2PkzGEHik3cyr/Ba91eP2rsGBjs5xh7Bax/iU2
nBvpZgEvQYaLFCm+5awwnzw7XaIWCs1EUa3gosOH1AuJXQTqGLYu9MWZ2rzWUFu9
XDmEwPqyl+fmnhg2Z90cUeZtdfxuhOOaUdEunbFxGpUDDYZrZ7FiMaKXMQae32zD
SOeEf1GzmxeuD0KuE4TSRRyiFn9HlivwJinze+sCAwEAAaN7MHkwCQYDVR0TBAIw
ADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUw
HQYDVR0OBBYEFA+HggkRbrlN0jZH3yuUlpnE8m7DMB8GA1UdIwQYMBaAFIO7y8Jq
SyD+EuhnoPYVNMKn0bsfMA0GCSqGSIb3DQEBCwUAA4IBAQArsEuv2FLXED8bxFcQ
F6LWp1PltCmK45L4Pr+tTWooNhyKBOGQRm+ZwxfuQ7ASN/dachaTXCvmjlCQf7Xt
pqDWLX9i+yOYfX0bOn2AH/SVEncyH0pu7QIvHrnHanpwDaeBBpciagYfIKoFaBjU
gBHpFBBiQxU6NNlYCZmgvNSxeUQ6HjMOMYnr7++qmlAUnjcVwBB9MeQyrg+eSYk2
MSWFm+9ltx7RbChAA3ELFvHv5MzOKADobTzp5UDUQ+FOPty9ODnPGPeExXlsO9Yj
F9/uuqzKACOg4oOmh9s0V8GPCMGVuDgoxuxOjPuWuscYPaBSUsD2eEzdjdL82FtA
pGnp
-----END CERTIFICATE-----

Walter H.

2016-Jun-16 17:56 UTC

head link

[CentOS] https and self signed

On 15.06.2016 15:57, ????????? ???????? wrote:> Nowadays it's quite easy to get normal ssl certificates for free. E.g.
>
> http://www.startssl.com
> http://buy.wosign.com/freethat is right, but hink of your potential clients, because
wosign has a problem - slow OCSP, ...
because their server infrastucture is located in China, and not the best 
bandwidth ...

when validity checks of the used SSL certificate very probable fail,
it is worse than not using SSL ...

Walter

Possibly Parallel Threads

Search for more possibly parallel threads

CentOS - Jun 2016 - https and self signed

[CentOS] https and self signed

[CentOS] https and self signed

[CentOS] https and self signed

[CentOS] https and self signed

[CentOS] https and self signed

[CentOS] https and self signed

[CentOS] https and self signed

[CentOS] https and self signed

[CentOS] https and self signed

Possibly Parallel Threads