It's simple to create a certificate for a client machine. First, you need to generate a public/private key pair for each entity, create a certificate request file, and then use
SSLeay to sign the file as a trusted authority.
For our example client
phoenix, this boils down to three SSLeay commands. The first generates a key pair for the client and places it in the file
phoenix.key. The private key will be encrypted, in this case using triple DES. Enter a pass phrase when requested below - you'll need it for the next step:
# ssleay genrsa -des3 1024 >phoenix.key
1112 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
........................................+++++
.............+++++
e is 65537 (0x10001)
Enter PEM pass phrase:
Verifying password - Enter PEM pass phrase:
After that command has completed, type in the following command:
#
ssleay req -new -key phoenix.key -out phoenix-csr
Enter PEM pass phrase:
Enter the pass phrase for the client certificate you just created (not the certificate authority). At this point, you will need to answer the questionnaire again, this time for the client machine. In addition, you must type in a challenge password and an optional company name - those do not matter here. When the command completes, you will have a certificate request in the file
phoenix-csr.
Then, you must sign the certificate request as the trusted certificate authority. Type in the following command:
#
ssleay ca -days 1000 -inflies phoenix-csr >phoenix.pem
This command will prompt you to enter the PEM pass phrase of the
certificate authority. Be sure that you do not enter the PEM pass phrase of the client certificate that you just created. After entering the correct pass phrase, you should see the following:
Check that the request matches the signature
Signature ok
The Subjects Distinguished Name is as follows:
...
This will be followed by the information that you just entered for the client certificate. If there is an error in the fields, the program will notify you. On the other hand, if everything is fine, SSLeay will confirm that it should sign the certificate and commit it to the database. This adds a record of the certificate to the
/etc/certificates/newcerts directory.
The operative files at the end of this exercise are the
phoenix.key and
phoenix.pem files, which reside in the current directory. These files will be passed off to the client with whom the SSL-enabled Samba server will interact, and will be used by SSL Proxy.
