Changes between Initial Version and Version 1 of APACHE_sharing_iplanet_cert

Timestamp:

12/03/14 12:11:18 (10 years ago)

Author:

lttoth@…

Comment:

--

APACHE_sharing_iplanet_cert

@@ +1 @@
+= Sharing iPlanet Certificates =
+    Original author:  Beth Mercer - 20080702
+
+== Overview ==
+Handling of certificates is managed different on the legacy systems, E boxes, than that of the IDMP-''x'' cluster.  The discussion is divided into two groups, 
+Apache and iPlanet share the certificate file requested by, and installed under, iPlanet.
+The crt and key file names/locations are indicated in the httpd.conf file:
+
+         * SSLCertificateFile:    /usr/local/Apache/ssl-certs/<''E Box''>.crt
+         * SSLCertificateKeyFile:  /usr/local/Apache/ssl-certs/<''E Box''>_private.key
+
+== Extracting CRT and Key Components from the iPlanet Certificate ==
+What follows is an example of the process for extracting the crt and key components from the
+iPlanet certificate.  The appropriate response to all password prompts is the token value
+stored in the following file on the legacy E boxes:
+
+         <''E Box''>:~iplanet/.ssl.pass  
+
+The entire listing of passwords used by the user, iplanet on the E Box servers is:IDMP-'xx' servers 
+The IDMP-x cluster servers have set up access based on functionality in a different way.  On those machines
+''Note:''  the output file name (./junk) in the commands below is arbitrary.
+Note:  the 'pk12util' command below is wrapped with <backslash-newline> on first line.
+
+iplanet@eklutna> /e01/iplanet/servers/shared/bin/pk12util -o ./junk \
+                 -d /e01/iplanet/servers/alias/ -n server-cert -P slapd-eklutna-
+
+Enter Password or Pin for "NSS Certificate DB":  *XXYYZZ*
+Enter password for PKCS12 file:  *XXYYZZ*
+Re-enter password:  *XXYYZZ*
+pk12util: PKCS12 EXPORT SUCCESSFUL
+
+++++++++++++++++++++++++++++++=
+In the above example: (see also: pkcs12 --help)
+
+        '-d /e01/iplanet/servers/alias/' references the location of cert/key database files.
+        '-P slapd-eklutna-' references the prefix associated with a particular directory.
+        '-n server-cert' references the nickname of a particular certificate in the cert/key database.
+
+Each nickname corresponds to a particular cert.  The nickname server-cert is the default nickname
+proposed by iPlanet.  That nickname is what we associated with the server name based certs (e.g. 
+the eklutna, elias, egegik and edgar certs are all associated with the server-cert nickname).
+More recently, certs requested under iPlanet are given more explicit nicknames like 'edirtest'.
+
+To obtain a list of nicknames from a specific key database:
+
+iplanet@eklutna> /e01/iplanet/servers/shared/bin/certutil -K -d /e01/iplanet/servers/alias -P slapd-eklutna-    
+Enter Password or Pin for "NSS Certificate DB":
+<0> 
+<1> server-cert
+++++++++++++++++++++++++++++++=
+
+iplanet@eklutna> ls -al ./junk
+-rw-------   1 iplanet  iplanet     2772 Oct 27 16:01 ./junk
+
+iplanet@eklutna> /usr/local/bin/openssl pkcs12 -clcerts -nokeys -in ./junk -out ./eklutna.crt
+Enter Import Password:  *XXYYZZ*
+MAC verified OK
+
+iplanet@eklutna> ls -lrt ./eklutna.crt
+-rw-r--r--   1 iplanet  iplanet     1245 Oct 27 16:02 ./eklutna.crt
+
+iplanet@eklutna> /usr/local/bin/openssl pkcs12 -nocerts -in ./junk -out ./eklutna_private.pem
+Enter Import Password:  *XXYYZZ*
+MAC verified OK
+Enter PEM pass phrase:  *XXYYZZ*
+Verifying - Enter PEM pass phrase:  *XXYYZZ*
+
+iplanet@eklutna> ls -lrt ./eklutna_private.pem
+-rw-r--r--   1 iplanet  iplanet     1105 Oct 27 16:05 ./eklutna_private.pem
+
+
+Create key without a pass phrase.
+
+iplanet@eklutna> /usr/local/bin/openssl rsa -in ./eklutna_private.pem -out ./eklutna_private.key
+Enter pass phrase for eklutna_private.key: <CR>  (null response)
+writing RSA key
+
+iplanet@eklutna> ls -lrt ./eklutna_private.key
+-rw-r--r--   1 iplanet  iplanet      887 Oct 27 16:06 ./eklutna_private.key
+
+
+Now tell 'root' user to move files from "~iplanet" to "/usr/local/Apache/ssl-certs/".
+
+Sample httpd.conf file usage:
+
+SSLCertificateFile /usr/local/Apache/ssl-certs/eklutna.crt
+SSLCertificateKeyFile /usr/local/Apache/ssl-certs/eklutna_private.key
+
+########################################################[[br]]
+LEGACY CHANGE HISTORY - NOTE: All subsequent changes are recorded in TracWiki[[br]]
+########################################################[[br]]
+20080702 sxelm  :       Added verbiage describing elements of the first pk12util example[[br]]
+20080702 sxclm  :       Fully qualified commands: pk12util and openssl.  Wrapped pk12util command line example with <backslash+newline>. If typing as one line, remove extraneous <backslash+whitespace>.[[br]]
+20061027 sxelm  :       Extracting Apache .crt and .key Files from iPlanet Certificate[[br]]