Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an in house project that needs to allow USB token based authentication. We managed to understand how this works, and how to setup our environment (Apache, HTTPS support, ask for SSL verified certificates in browser, identify the user from the certificate).

Mostly we studied after http://cweiske.de/tagebuch/ssl-client-certificates.htm

Now we face the issue that we can't generate valid certificates. We cannot buy them at this phase of the project. We all are developers and we need to test different scenarios. And to be able to build the app login systemwe are in need to generate or simulate the working environment.

  • That means we need to verify if the certificates are valid.
  • the certificates contains the unique ID we are after, like name and email of the holder.
  • certificates issued under different CA authority files can have the same serial.
  • certificates can contain multiple chains, we need to generate multiple chains valid/failed ones.
  • certificates can be expired (probably the easiest to do)
  • certificates can be revoked.

What can we do to setup a whole sandboxing environment with valid CA files, valid certificates, expired ones, and even more the most important one is revoked certificates, as we need to check against the OCSP if the certificate is revoked.

How would you setup such a developing environment to test these inhouse? What tools can we use to easy our task?

share|improve this question

closed as not a real question by womble, voretaq7 Jul 26 '12 at 20:49

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Based on your replies to @Womble's answer below we really can't help you with all of the things you need to learn -- you are missing the core knowledge that would underly any explanation we would give, and a Q&A site is not a good classroom for that kind of learning. The best starting point I can offer is the Wikipedia page on PKI... –  voretaq7 Jul 26 '12 at 20:49
    
There are also numerous tutorials on creating a local CA with OpenSSL (<-- Google term), such as this one which will help you with the mechanical bit of setting up your local CA and issuing certificates, once you have the core knowledge... –  voretaq7 Jul 26 '12 at 20:52

1 Answer 1

openssl and some shell scripts should be enough. You can generate locally-trusted CA cert/keys, sign CSRs with those, revoke them, and all the rest of it. There's also pre-built CA management GUIs and command line toolsets, but the hard bit is understanding how it all works (and given that what you want to do isn't a standard use-case, you'll need to understand how it all works under the hood). The mechanics of executing the required transformations is trivial.

share|improve this answer
    
If you happen to know some tools, please list them, as we will research it. Also if you happen to know tutorials or some pages where others document how they did this process it would be helpful too. –  Pentium10 Jul 22 '12 at 8:55
    
So to clarify: you don't already know how SSL works? –  womble Jul 22 '12 at 8:57
    
If you go quickly over the article I mentioned, you can assume we know all that, and only that. We run the commands to generate the certificates that are listed there. But we were not able to generate a valid certificate chain. Technically speaking we were able to see in PHP that those variables came in the $_SERVER, but it was all the SSL part only, and the MOST important one, like serial and user name, email were not listed. –  Pentium10 Jul 22 '12 at 9:13
2  
Oh wow... you've got a serious amount of learning to do. –  womble Jul 22 '12 at 9:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.