We have an in house project that needs to allow USB token based authentication. We managed to understand how this works, and how to setup our environment (Apache, HTTPS support, ask for SSL verified certificates in browser, identify the user from the certificate).
Mostly we studied after http://cweiske.de/tagebuch/ssl-client-certificates.htm
Now we face the issue that we can't generate valid certificates. We cannot buy them at this phase of the project. We all are developers and we need to test different scenarios. And to be able to build the app login systemwe are in need to generate or simulate the working environment.
- That means we need to verify if the certificates are valid.
- the certificates contains the unique ID we are after, like name and email of the holder.
- certificates issued under different CA authority files can have the same serial.
- certificates can contain multiple chains, we need to generate multiple chains valid/failed ones.
- certificates can be expired (probably the easiest to do)
- certificates can be revoked.
What can we do to setup a whole sandboxing environment with valid CA files, valid certificates, expired ones, and even more the most important one is revoked certificates, as we need to check against the OCSP if the certificate is revoked.
How would you setup such a developing environment to test these inhouse? What tools can we use to easy our task?