PrivCert - Private CA for management of user certs

What is this?

Simple script to manage user certs to be used for client certification on the restricted websites.

It sets up self-signed CA and generates client certs per user.

Requirement

• OpenSSL
• Web server (such as apache)

Installation

$ make
$ sudo make install

Variables available on make:

• CA_ROOT - where certs are stored at
  • default: /etc/privcert
• OPENSSL - openssl executable path
  • default: (auto detected)
• MD5SUM - md5sum executable path
  • default: (auto detected)
• BASE64 - base64 executable path
  • default: (auto detected)
• DN_BASE - prefix to X.509 DN
  • default: /C=JP/ST=Tokyo/O=Your Company
  • requires C, ST and O
  • must omit CN and emailAddress (to be set individually)
• EXTRACT_PWD - password to extract user cert on install
  • default: privcert
• CERT_NAME - default name of user cert
  • default: PrivCert
  • recommended to set the site name
• UPDATE_HOOK - hook to reconfigure web server
  • default: apachectl restart (with auto detected executable path)
• KEYLEN - default key length in bits
  • default: 2048
  • can be overridden by -l option
• EXPIRE - default certs expiration in days
  • default: 3650(≒10yr)
  • can be overridden by -e option

Variables available on make install:

• PREFIX - install prefix, default is /usr/local.
• BINDIR - where executables are installed at, default is $(PREFIX)/sbin.

Also DESTDIR, useful when making packages, available.

Preparation

First, init the environment and generate self-signed cert for local CA:

Note

On most systems, privcert executable installed in /usr/local/sbin is not found under sudo due to overridden $PATH for security reasons. So consider adding -i option to bring $PATH from root environment.

$ sudo -i privcert init

Then, input password for server mode twice.

Note

If omit password or failed to set password, retry init to initialize password.

Once initialized password, try sudo -i privcert passwd to update.

Set generated cert on the ssl configuration of your web server. For Apache, append below to the VirtualHost directive in ssl.conf:

Note

ssl.conf would be found under /etc/httpd/conf.d on RHEL or compatible system. It might have other location or filename, for example, default-ssl.conf under /etc/apache2/sites-available on Ubuntu or Debian variants.

SSLCACertificateFile /etc/privcert/ca/cert.pem
SSLVerifyClient optional
SSLVerifyDepth 10
SSLCARevocationCheck leaf
SSLCARevocationFile /etc/privcert/ca/crl.pem

SSLRequire %{SSL_CLIENT_S_DN_O} eq "Y̲o̲u̲r̲ ̲C̲o̲m̲p̲a̲n̲y̲"

Change condition value in SSLRequire to O value of DN specified to DN_BASE, from the default of "Your Company".

Note

In addition, might already have specified SSLCertificateFile and SSLCertificateKeyFile to enable SSL with an appropriate server cert.

Update apache configuration to make those valid:

$ sudo apachectl restart

Now the site is not accessible until installing the client cert signed by this ca.

Setup web interface (optional)

To use with web interface, register privcert as a service and modify some configuration after setup the webapp.

See web/README.md for more details.

User certs management

Make user cert

$ sudo -i privcert make u̲s̲e̲r̲ [c̲n̲] [e̲m̲a̲i̲l̲]

To make the site accessible, import the cert file generated at /etc/privcert/users/u̲s̲e̲r̲.pfx into the environment of the user. Ordinary, just double-click or tap that file to import into the system cert store, or, on some environments, might need to import from the cert management menu of the browser.

The fixed password set on EXTRACT_PWD, default to be privcert, is necessary.

Web interface should be useful to distribute certs.

Show all user certs

$ sudo -i privcert list

It shows only certs just under /etc/privcert/users, which should hold only valid ones.

Revoke user cert

$ sudo -i privcert revoke u̲s̲e̲r̲

Revoked cert is added to certificate revocation list (crl.pem), so the client with the cert could no longer access. And the cert is moved to /etc/privcert/trash.

ToDo

• Server certificate (to use with VPN server)
• Update CA cert (necessary?)

Copyright and License

Copyright (c)2024 Shun-ichi TAHARA <[email protected]>

Provided under MIT license, with the exception of third-party/getoptions directory, which is appropriated from ko1nksm/getoptions of CC0 license.