Changeset 638a6a4


Ignore:
Timestamp:
02/24/2019 05:03:15 AM (5 years ago)
Author:
DJ Lucas <dj@…>
Branches:
10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 8.4, 9.0, 9.1, kea, ken/inkscape-core-mods, lazarus, lxqt, plabs/python-mods, qt5new, trunk, upgradedb, xry111/intltool, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
28b75d3
Parents:
91b2565
Message:

Moved example configuration for make-ca to the configuration section.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@21237 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:
3 edited

Legend:

Unmodified
Added
Removed

  • general.ent

    r91b2565 r638a6a4  
    11<!-- $LastChangedBy$ $Date$ -->
    22
    3 <!ENTITY day          "22">                   <!-- Always 2 digits -->
     3<!ENTITY day          "24">                   <!-- Always 2 digits -->
    44<!ENTITY month        "02">                   <!-- Always 2 digits -->
    55<!ENTITY year         "2019">
    … …  
    77<!ENTITY copyholder   "The BLFS Development Team">
    88<!ENTITY version      "&year;-&month;-&day;">
    9 <!ENTITY releasedate  "February 22nd, &year;">
     9<!ENTITY releasedate  "February 24th, &year;">
    1010<!ENTITY pubdate      "&year;-&month;-&day;"> <!-- metadata req. by TLDP -->
    1111<!ENTITY blfs-version "svn">                  <!-- svn|[release #] -->

  • introduction/welcome/changelog.xml

    r91b2565 r638a6a4  
    4242    </listitem>
    4343-->
     44    <listitem>
     45      <para>February 24th, 2019</para>
     46      <itemizedlist>
     47        <listitem>
     48          <para>[dj] - Moved example configuration for make-ca to the
     49          configuration section.</para>
     50        </listitem>
     51      </itemizedlist>
     52    </listitem>
     53
    4454    <listitem>
    4555      <para>February 22nd, 2019</para>

  • postlfs/security/make-ca.xml

    r91b2565 r638a6a4  
    103103    on the system). Any local certificates stored in
    104104    <filename>/etc/ssl/local</filename> will be imported to both the trust
    105     anchors and the generated certificate stores (overriding Mozilla's trust).
    106     Certificates in this directory should be stored as PEM encoded
    107     <application>OpenSSL</application> trusted certificates.</para>
    108 
    109     <para>To create an <application>OpenSSL</application> trusted certificate
    110     from a regular PEM encoded file, you need to add trust arguments to the
    111     <command>openssl</command> command, and create a new certificate. There are
    112     three trust types that are recognized by the
    113     <application>make-ca</application> script, SSL/TLS, S/Mime, and code
    114     signing. For example, using the
    115     <ulink url="http://www.cacert.org/">CAcert</ulink> roots, if you want to
    116     trust both for all three roles, the following commands will create
    117     appropriate OpenSSL trusted certificates (run as the <systemitem
    118     class="username">root</systemitem> user after
    119     <xref linkend="wget"/> is installed):</para>
    120 
    121 <screen role="nodump"><userinput>install -vdm755 /etc/ssl/local &amp;&amp;
    122 wget http://www.cacert.org/certs/root.crt &amp;&amp;
    123 wget http://www.cacert.org/certs/class3.crt &amp;&amp;
    124 openssl x509 -in root.crt -text -fingerprint -setalias "CAcert Class 1 root" \
    125         -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
    126         > /etc/ssl/local/CAcert_Class_1_root.pem &amp;&amp;
    127 openssl x509 -in class3.crt -text -fingerprint -setalias "CAcert Class 3 root" \
    128         -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
    129         > /etc/ssl/local/CAcert_Class_3_root.pem</userinput></screen>
    130 
    131     <para>If one of the three trust arguments is omitted, the certificate is
    132     neither trusted, nor rejected for that role. Clients that use
    133     <application>OpenSSL</application> or <application>NSS</application>
    134     encountering this certificate will present a warning to the user. Clients
    135     using <application>GnuTLS</application> without
    136     <application>p11-kit</application> support are not aware of trusted
    137     certificates. To include this CA into the ca-bundle.crt (used for
    138     <application>GnuTLS</application>), it must have <envar>serverAuth</envar>
    139     trust. Additionally, to explicitly disallow a certificate for a particular
    140     use, replace the <parameter>-addtrust</parameter> flag with the
    141     <parameter>-addreject</parameter> flag.</para>
     105    anchors and the generated certificate stores (overriding Mozilla's
     106    trust).</para>
    142107
    143108    <para>To install the various certificate stores, first install the
    … …  
    165130    <filename>/etc/ssl/ca-bundle.crt</filename> for the
    166131    <xref linkend="gnutls"/> certificate store. If software is still installed
    167     that references this file, create a compatibilty symlink for the old
     132    that references this file, create a compatibility symlink for the old
    168133    location as the <systemitem class="username">root</systemitem> user:</para>
    169134
    … …  
    198163    <title>Configuring make-ca</title>
    199164
    200     <para>Genearally, no configuration is necessary on an LFS system, however,
     165    <para>For most users, no additional configuration is necessary, however,
    201166    the default <filename>certdata.txt</filename> file provided by make-ca
    202167    is obtained from the mozilla-release branch, and is modified to provide a
    … …  
    213178      <primary sortas="e-etc-make-ca-conf">/etc/make-ca.conf</primary>
    214179    </indexterm>
     180
     181    <bridgehead renderas="sect3">About Trust Arguments</bridgehead>
     182
     183    <para>There are three trust types that are recognized by the
     184    <application>make-ca</application> script, SSL/TLS, S/Mime, and code
     185    signing. For <application>OpenSSL</application>, these are
     186    <parameter>serverAuth</parameter>, <parameter>emailProtection</parameter>,
     187    and <parameter>codeSigning</parameter> respectively. If one of the three
     188    trust arguments is omitted, the certificate is neither trusted, nor
     189    rejected for that role. Clients that use <application>OpenSSL</application>
     190    or <application>NSS</application> encountering this certificate will
     191    present a warning to the user. Clients using
     192    <application>GnuTLS</application> without
     193    <application>p11-kit</application> support are not aware of trusted
     194    certificates. To include this CA into the
     195    <filename>ca-bundle.crt</filename>,
     196    <filename>email-ca-bundle.crt</filename>, or
     197    <filename>objsign-ca-bundle.crt</filename> files
     198    (the <application>GnuTLS</application> legacy bundles), it must have the
     199    appropriate trust arguments.</para>
     200
     201    <bridgehead renderas="sect3">Adding Additional CA Certificates</bridgehead>
     202
     203    <para>The <filename class="directory">/etc/ssl/local</filename> directory
     204    is available to add additional CA certificates to the system. For instance,
     205    you might need to add an organization or government CA certificate.
     206    Files in this directory must be in the <application>OpenSSL</application>
     207    trusted certificate format. To create an <application>OpenSSL</application>
     208    trusted certificate from a regular PEM encoded file, you need to add trust
     209    arguments to the <command>openssl</command> command, and create a new
     210    certificate. For example, using the
     211    <ulink url="http://www.cacert.org/">CAcert</ulink> roots, if you want to
     212    trust both for all three roles, the following commands will create
     213    appropriate OpenSSL trusted certificates (run as the
     214    <systemitem class="username">root</systemitem> user after
     215    <xref linkend="wget"/> is installed):</para>
     216
     217<screen role="nodump"><userinput>install -vdm755 /etc/ssl/local &amp;&amp;
     218wget http://www.cacert.org/certs/root.crt &amp;&amp;
     219wget http://www.cacert.org/certs/class3.crt &amp;&amp;
     220openssl x509 -in root.crt -text -fingerprint -setalias "CAcert Class 1 root" \
     221        -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
     222        > /etc/ssl/local/CAcert_Class_1_root.pem &amp;&amp;
     223openssl x509 -in class3.crt -text -fingerprint -setalias "CAcert Class 3 root" \
     224        -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
     225        > /etc/ssl/local/CAcert_Class_3_root.pem</userinput></screen>
     226
     227    <bridgehead renderas="sect3">Overriding Mozilla Trust</bridgehead>
     228
     229    <para>Occasionally, there may be instances where you don't agree with
     230    Mozilla's inclusion of a particular certificate authority. If you'd like
     231    to override the default trust of a particular CA, simply create a copy of
     232    the existing certificate in
     233    <filename class="directory">/etc/ssl/local</filename> with different trust
     234    arguments. For example, if you'd like to distrust the "Makebelieve_CA_Root"
     235    file, run the following commands:</para>
     236
     237<screen role="nodump"><userinput>install -vdm755 /etc/ssl/local &amp;&amp;
     238openssl x509 -in /etc/ssl/certs/Makebelieve_CA_Root.pem \
     239             -text \
     240             -fingerprint
     241             -setalias "Disabled Makebelieve CA Root" \
     242             -addreject serverAuth \
     243             -addreject emailProtection \
     244             -addreject codeSigning \
     245       > /etc/ssl/local/Disabled_Makebelieve_CA_Root.pem &amp;&amp;
     246/usr/sbin/make-ca -r -f</userinput></screen>
    215247
    216248  </sect2>
Note: See TracChangeset for help on using the changeset viewer.