up vote 0 down vote favorite
share [g+] share [fb]

I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project).

I have found these lines on the OpenSSL Project:

openssl req -new -config openssl.cnf -out proxy.req -keyout proxy.key

openssl x509 -req -CAcreateserial -in proxy.req -days 7 -out proxy.crt -CA user.crt -CAkey user.key -extfile openssl.cnf -extensions proxy_cert_ext

... but I don't know what is the role of "user.crt" ? I do not have this file. I have tried to create it with a tutorial about a self-signed SSL Certificate, but I'm lost in the documentation :(

So:

  • What are the requirements for an ssl proxy ?
  • A 'Certificate Authority' is really necessary for this project ?
    (To keep it simple I don't wish at this time for my program to include many checks on the clients authentication. I would like the SSL client to be tolerant of my program and accept a connection (even without much security) so that I can quickly check that it works.)
link|improve this question
2  
Please explain your system architecture in more detail. It is not clear why you need proxy certificates at all. Generally, they are needed when identity delegation is required. That is, a server does a job on user's behalf and needs to prove to other servers that it has a right to do so. Which means that there's a client certificate to begin with (this is the user.crt of your example). – n.m. Aug 27 '11 at 7:02
Agree with n.m., you need to provide more information about your architecture. i.e. If you are doing two-way SSL authentication your proxy is probably providing SSL termination to the backend HTTP Server. i.e. It is the proxy that is providing the transport layer security to the client and checking the client certificate. In other words the proxy communicates with the HTTP Server in clear text (on a private VLAN). At any rate you might want to check out the utility CA.pl that comes with most distros as it provides a friendlier interface to creating and signing certificates. – HTTP500 Aug 27 '11 at 15:33
feedback

migrated from stackoverflow.com Aug 27 '11 at 13:56

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 0 down vote

Well the requirements for an SSL proxy are SSL certificates, and the webserver that is configured to use it. If it is just for testing you can use self signt certificates, generatet via openssl cli or you use tinyCA2 which gives you a GUI for that job. For Production startssl.com is a good place to look at valid class1 certs for free.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard