4

I want to start making client certifications to secure some internal services. The ones are some web services and an internal Jabber server.

And if the process is easy enough maybe make certificates for the authorized clients.

update: I'm looking for a AIX or Windows Server 2008 solution.

2
  • Is it safe to assume, as the first answer does, that you are asking about doing this on Windows?
    – David Z
    Jul 25, 2009 at 5:44
  • Yeah what OS do you prefer to set this up on, that will definitely shape the answer given.
    – Tatas
    Jul 25, 2009 at 5:50

3 Answers 3

9

If you have OpenSSL, you can use my handy guide.

2
  • That's a really straightforward and helpful guide; thanks for writing that up.
    – Hans L
    Sep 6, 2012 at 12:12
  • You should copy the relevant pieces of your guide to your answer instead of just linking your blog (which may or may not always be around).
    – user62491
    Aug 7, 2013 at 17:14
1

First thing you need to do is make sure Certificate Services component of windows server is installed. This allows creation of certificates for servers. I believe one server has to be the certificate authority.

Start->Add/Remove Programs->Add/Remove Windows Components->Check Certificate Services

First start with a root authority.

Then once this is installed, you can make certificates for individual servers.

Start->Administrative Tools->Internet Information Services (IIS) Manager Right click a website, and click properties. Directory Services Tab->Secure Communications

Once that is done, you need to use the Root CA to accept the certificate request.

Go to http://server/certsrv you can have the certificate accepted by the Root CA

1
  • I also think that all the clients need to be configured to accept the Root CA as valid, which in itself can be management problem.
    – pcapademic
    Jul 25, 2009 at 6:45
0

If you really are a masochist and want to run your own CA, you can use:

  1. Open CA. This can be run inside JBoss/Tomcat/ you can get it from openca.org

  2. OpenSSL also comes with it's own CA capability. search for openssl + ca

  3. There is a python CA available at pyca.de

Says on the bottom of the page that this is no longer actively maintained.

I gave up torturing myself and found that the best way of getting and more importantly managing free certs was to use CACert.org:

http://www.cacert.org/

Sign up and you can create certificates for free, they are the CA and have a root cert you can import into your keystore so you don't get the annoying questions from the browser etc. Takes a lot of the pain out of managing your own CA like they send you an e-mail when certs are going to expire etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .