Showing posts with label certificate. Show all posts
Showing posts with label certificate. Show all posts

# SimpleHTTPSServer with letsencrypt certificate 


# apt-get update
# apt-get install software-properties-common
# add-apt-repository ppa:certbot/certbot
# apt-get update
# mkdir webserver
# cd webserver
# apt-get install certbot
# mkdir www
# certbot certonly --webroot -w $PWD/www -d mydomain.org -d www.mydomain.org
# cp /etc/letsencrypt/live/mydomain.org/privkey.pem .
# cp /etc/letsencrypt/live/mydomain.org/fullchain.pem .
# cat privkey.pem fullchain.pem > cert.pem
# cat https-server.py
import BaseHTTPServer, SimpleHTTPServer
import os
import ssl
import sys

port = 443

iface = sys.argv[1]
ipv4 = os.popen('ip addr show ' + iface).read().split('inet ')[1].split('/')[0]

cwd = os.getcwd()
certfile = cwd + '/cert.pem'
wwwdir = cwd + '/www'

os.chdir(wwwdir)

httpd = BaseHTTPServer.HTTPServer((ipv4, port), SimpleHTTPServer.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket, certfile = certfile, server_side = True)
httpd.serve_forever()
# python https-server.py eth0
Posted by t0n1 0 comments
Labels: , , , , ,

# Wired 802.1x with EAP/TLS


Authentication server (Freeradius)

# apt-get install freeradius openssl
# mkdir /etc/ssl/CA
# mkdir /etc/ssl/newcerts
# echo '01' > /etc/ssl/CA/serial
# touch /etc/ssl/CA/index.txt
# cat /etc/ssl/openssl.cnf
...
[ CA_default ]

dir             = /etc/ssl
database        = $dir/CA/index.txt
certificate     = $dir/certs/cacert.pem
serial          = $dir/CA/serial
private_key     = $dir/private/cakey.pem
...
# cd /etc/ssl/CA
# openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650
Generating a 1024 bit RSA private key
.................++++++
.........++++++
writing new private key to 'cakey.pem'
Enter PEM pass phrase:MY_SECRET
Verifying - Enter PEM pass phrase:MY_SECRET
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:ES
State or Province Name (full name) [Some-State]:CAT
Locality Name (eg, city) []:BCN
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCA
Organizational Unit Name (eg, section) []:AAA
Common Name (e.g. server FQDN or YOUR name) []:ca.lab.net
Email Address []:root@lab.net
# mv cakey.pem /etc/ssl/private/.
# mv cacert.pem /etc/ssl/certs/.
# cat >> /etc/ssl/CA/xpextensions << eof
> [xpclient_ext]
> extendedKeyUsage=1.3.6.1.5.5.7.3.2
>
> [xpserver_ext]
> extendedKeyUsage=1.3.6.1.5.5.7.3.1
> eof
# openssl req -new -nodes -keyout freeradiuskey.pem -out freeradius.csr -days 3650
Generating a 1024 bit RSA private key
......++++++
..................++++++
writing new private key to 'freeradiuskey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:ES
State or Province Name (full name) [Some-State]:CAT
Locality Name (eg, city) []:BCN
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCA
Organizational Unit Name (eg, section) []:AAA
Common Name (e.g. server FQDN or YOUR name) []:freeradius.lab.net
Email Address []:root@lab.net

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# openssl ca -in freeradius.csr -config /etc/ssl/openssl.cnf
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for /etc/ssl/private/cakey.pem:MY_SECRET
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jan 15 18:28:48 2013 GMT
            Not After : Jan 15 18:28:48 2014 GMT
        Subject:
            countryName               = ES
            stateOrProvinceName       = CAT
            organizationName          = MyCA
            organizationalUnitName    = AAA
            commonName                = freeradius.lab.net
            emailAddress              = root@lab.net
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                78:3A:A1:E4:7E:69:FC:71:CD:45:22:AF:52:C0:4A:D8:E1:1F:99:20
            X509v3 Authority Key Identifier:
                keyid:14:75:4E:1F:6B:E3:FD:5A:88:77:71:93:60:32:81:6C:D5:AD:10:C4

Certificate is to be certified until Jan 15 18:28:48 2014 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ES, ST=CAT, L=BCN, O=MyCA, OU=AAA, CN=ca.lab.net/emailAddress=root@lab.net
        Validity
            Not Before: Jan 15 18:28:48 2013 GMT
            Not After : Jan 15 18:28:48 2014 GMT
        Subject: C=ES, ST=CAT, O=MyCA, OU=AAA, CN=freeradius.lab.net/emailAddress=root@lab.net
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:d1:7a:a6:74:ce:cd:b1:96:1b:5b:f1:21:8b:45:
                    fe:52:a0:c4:ac:84:8a:ad:05:65:97:5e:fd:af:bb:
                    7d:1d:e9:9a:91:8d:46:48:16:83:88:90:da:03:b3:
                    5d:32:e2:e4:e3:2f:73:18:41:26:73:26:f3:32:03:
                    c0:02:a5:be:04:9e:36:40:99:cc:1b:52:03:4d:8a:
                    2a:9c:9f:65:10:56:0c:09:a9:26:fb:6e:09:78:e1:
                    00:28:b1:c6:b0:97:e3:87:78:ea:fe:89:24:8a:86:
                    5d:44:8f:70:bf:43:a4:a2:d0:23:b9:f7:ee:ae:48:
                    d1:fb:98:1e:61:d8:6c:87:cb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                78:3A:A1:E4:7E:69:FC:71:CD:45:22:AF:52:C0:4A:D8:E1:1F:99:20
            X509v3 Authority Key Identifier:
                keyid:14:75:4E:1F:6B:E3:FD:5A:88:77:71:93:60:32:81:6C:D5:AD:10:C4

    Signature Algorithm: sha1WithRSAEncryption
         b9:41:6b:0e:57:88:a2:aa:a6:d1:5d:55:f0:1c:48:3f:c8:4f:
         97:09:65:1a:f7:08:45:f0:e4:10:e6:32:67:14:2f:6e:4f:b0:
         a0:21:56:96:32:90:5b:4c:78:01:40:05:92:4a:d3:2c:c2:11:
         77:a8:0d:3b:49:cb:2f:e4:22:99:44:0d:2a:0d:1e:6a:d1:3d:
         2e:72:19:46:9d:0e:3c:a3:3e:bf:a6:1e:2f:5c:f0:71:8a:b7:
         09:11:97:e1:0d:0e:29:5d:30:aa:87:e9:9d:37:86:13:c6:bd:
         8b:05:d5:c1:ec:c1:31:f8:79:a2:c2:16:92:c2:13:bd:aa:a6:
         89:37
-----BEGIN CERTIFICATE-----
MIIC2zCCAkSgAwIBAgIBATANBgkqhkiG9w0BAQUFADB4MQswCQYDVQQGEwJFUzEM
MAoGA1UECAwDQ0FUMQwwCgYDVQQHDANCQ04xDTALBgNVBAoMBE15Q0ExDDAKBgNV
BAsMA0FBQTETMBEGA1UEAwwKY2EubGFiLm5ldDEbMBkGCSqGSIb3DQEJARYMcm9v
dEBsYWIubmV0MB4XDTEzMDExNTE4Mjg0OFoXDTE0MDExNTE4Mjg0OFowcjELMAkG
A1UEBhMCRVMxDDAKBgNVBAgMA0NBVDENMAsGA1UECgwETXlDQTEMMAoGA1UECwwD
QUFBMRswGQYDVQQDDBJmcmVlcmFkaXVzLmxhYi5uZXQxGzAZBgkqhkiG9w0BCQEW
DHJvb3RAbGFiLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0XqmdM7N
sZYbW/Ehi0X+UqDErISKrQVll179r7t9HemakY1GSBaDiJDaA7NdMuLk4y9zGEEm
cybzMgPAAqW+BJ42QJnMG1IDTYoqnJ9lEFYMCakm+24JeOEAKLHGsJfjh3jq/okk
ioZdRI9wv0OkotAjuffurkjR+5geYdhsh8sCAwEAAaN7MHkwCQYDVR0TBAIwADAs
BglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYD
VR0OBBYEFHg6oeR+afxxzUUir1LAStjhH5kgMB8GA1UdIwQYMBaAFBR1Th9r4/1a
iHdxk2AygWzVrRDEMA0GCSqGSIb3DQEBBQUAA4GBALlBaw5XiKKqptFdVfAcSD/I
T5cJZRr3CEXw5BDmMmcUL25PsKAhVpYykFtMeAFABZJK0yzCEXeoDTtJyy/kIplE
DSoNHmrRPS5yGUadDjyjPr+mHi9c8HGKtwkRl+ENDildMKqH6Z03hhPGvYsF1cHs
wTH4eaLCFpLCE72qpok3
-----END CERTIFICATE-----
Data Base Updated
# cp /etc/ssl/newcerts/01.pem freeradius.pem
# cat freeradiuskey.pem > freeradiuskeycert.pem
# grep -A 100 BEGIN freeradius.pem >> freeradiuskeycert.pem
# openssl req -new -nodes -keyout wxpkey.pem -out wxp.csr -days 3650
Generating a 1024 bit RSA private key
.........................++++++
...++++++
writing new private key to 'wxpkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:ES
State or Province Name (full name) [Some-State]:CAT
Locality Name (eg, city) []:BCN
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCA
Organizational Unit Name (eg, section) []:AAA
Common Name (e.g. server FQDN or YOUR name) []:wxp.lab.net
Email Address []:root@lab.net

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# openssl ca -in wxp.csr -config /etc/ssl/openssl.cnf -extensions xpclient_ext -extfile /etc/ssl/CA/xpextensions
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for /etc/ssl/private/cakey.pem:MY_SECRET
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: Jan 15 18:34:05 2013 GMT
            Not After : Jan 15 18:34:05 2014 GMT
        Subject:
            countryName               = ES
            stateOrProvinceName       = CAT
            organizationName          = MyCA
            organizationalUnitName    = AAA
            commonName                = wxp.lab.net
            emailAddress              = root@lab.net
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
Certificate is to be certified until Jan 15 18:34:05 2014 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ES, ST=CAT, L=BCN, O=MyCA, OU=AAA, CN=ca.lab.net/emailAddress=root@lab.net
        Validity
            Not Before: Jan 15 18:34:05 2013 GMT
            Not After : Jan 15 18:34:05 2014 GMT
        Subject: C=ES, ST=CAT, O=MyCA, OU=AAA, CN=wxp.lab.net/emailAddress=root@lab.net
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c3:b9:f0:f7:09:c4:89:85:30:b4:e8:83:99:39:
                    c3:19:49:c6:b5:9e:df:28:88:6a:4c:f9:7f:9d:45:
                    92:a3:e3:22:18:9a:3b:ff:49:20:f9:63:97:59:d8:
                    b4:49:73:ea:0e:76:e0:62:d2:6b:25:35:fa:14:c3:
                    31:26:7d:33:db:7f:42:5d:ad:a6:48:11:32:a7:e0:
                    0b:9b:77:45:4d:cb:68:66:28:30:48:fd:43:8b:d7:
                    d3:c3:36:a6:bd:9a:83:76:2f:34:65:a5:aa:53:97:
                    e8:fc:e8:83:74:6e:a7:84:74:8c:0b:36:b6:f3:9a:
                    d5:d8:6d:39:ba:e2:2b:27:a5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
    Signature Algorithm: sha1WithRSAEncryption
         25:3b:75:12:2b:d0:9f:bd:02:e3:9b:8f:b3:04:ee:82:80:60:
         08:0c:1e:60:19:e0:3b:10:5d:0f:6c:4e:50:29:1a:50:0f:1d:
         3c:a5:a1:af:ce:73:42:c7:d7:81:b8:68:3a:40:c6:88:4e:cd:
         fa:b8:f4:65:34:44:6b:6a:85:6e:8a:5e:34:19:4f:3a:5f:45:
         8b:4f:ac:35:5d:26:55:bf:eb:4c:b7:fa:83:25:cd:62:78:07:
         4c:48:3d:e1:51:5d:21:26:33:9f:05:8b:fc:8a:99:6b:cf:70:
         ce:23:ae:f4:04:d8:aa:20:f7:11:02:c0:3f:dc:b1:24:f2:1b:
         0d:f5
-----BEGIN CERTIFICATE-----
MIICcDCCAdmgAwIBAgIBAjANBgkqhkiG9w0BAQUFADB4MQswCQYDVQQGEwJFUzEM
MAoGA1UECAwDQ0FUMQwwCgYDVQQHDANCQ04xDTALBgNVBAoMBE15Q0ExDDAKBgNV
BAsMA0FBQTETMBEGA1UEAwwKY2EubGFiLm5ldDEbMBkGCSqGSIb3DQEJARYMcm9v
dEBsYWIubmV0MB4XDTEzMDExNTE4MzQwNVoXDTE0MDExNTE4MzQwNVowazELMAkG
A1UEBhMCRVMxDDAKBgNVBAgMA0NBVDENMAsGA1UECgwETXlDQTEMMAoGA1UECwwD
QUFBMRQwEgYDVQQDDAt3eHAubGFiLm5ldDEbMBkGCSqGSIb3DQEJARYMcm9vdEBs
YWIubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDufD3CcSJhTC06IOZ
OcMZSca1nt8oiGpM+X+dRZKj4yIYmjv/SSD5Y5dZ2LRJc+oOduBi0mslNfoUwzEm
fTPbf0JdraZIETKn4Aubd0VNy2hmKDBI/UOL19PDNqa9moN2LzRlpapTl+j86IN0
bqeEdIwLNrbzmtXYbTm64isnpQIDAQABoxcwFTATBgNVHSUEDDAKBggrBgEFBQcD
AjANBgkqhkiG9w0BAQUFAAOBgQAlO3USK9CfvQLjm4+zBO6CgGAIDB5gGeA7EF0P
bE5QKRpQDx08paGvznNCx9eBuGg6QMaITs36uPRlNERraoVuil40GU86X0WLT6w1
XSZVv+tMt/qDJc1ieAdMSD3hUV0hJjOfBYv8iplrz3DOI670BNiqIPcRAsA/3LEk
8hsN9Q==
-----END CERTIFICATE-----
Data Base Updated 
# cp /etc/ssl/newcerts/02.pem wxp.pem
# openssl pkcs12 -export -in wxp.pem -inkey wxpkey.pem -certfile /etc/ssl/certs/cacert.pem -name "Wired-dot1x" -out wxp.p12
Enter Export Password:MY_EXPORT
Verifying - Enter Export Password:MY_EXPORT
# cp /etc/ssl/certs/cacert.pem /etc/freeradius/certs/.
# cp /etc/ssl/CA/freeradiuskeycert.pem /etc/freeradius/certs/.
# cp /etc/freeradius/eap.conf /etc/freeradius/eap.conf.orig
# cat /etc/freeradius/eap.conf
        eap {
                default_eap_type = tls
                timer_expire     = 60
                ignore_unknown_eap_types = no
                cisco_accounting_username_bug = no
                max_sessions = 4096
                md5 {
                }
                leap {
                }
                gtc {
                        auth_type = PAP
                }
                tls {
                        certdir = ${confdir}/certs
                        cadir = ${confdir}/certs
                        private_key_file = ${certdir}/freeradiuskeycert.pem
                        certificate_file = ${certdir}/freeradiuskeycert.pem
                        CA_file = ${cadir}/cacert.pem
                        dh_file = ${certdir}/dh
                        random_file = /dev/urandom
                        fragment_size = 1024
                        include_length = yes
                        CA_path = ${cadir}
                        cipher_list = "DEFAULT"
                        make_cert_command = "${certdir}/bootstrap"
                        cache {
                              enable = no
                              max_entries = 255
                        }
                        verify {
                        }
                }
                ttls {
                        default_eap_type = md5
                        copy_request_to_tunnel = no
                        use_tunneled_reply = no
                        virtual_server = "inner-tunnel"
                }
                peap {
                        default_eap_type = mschapv2
                        copy_request_to_tunnel = no
                        use_tunneled_reply = no
                        virtual_server = "inner-tunnel"
                }
                mschapv2 {
                }
        }
# /etc/init.d/freeradius stop
# freeradius -X


Authenticator/NAS (Cisco Catalyst 2960)

Switch(config)# aaa new-model
Switch(config)# radius server freeradius
Switch(config-radius-server)# address ipv4 192.168.0.100 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key MYSECRET
Switch(config)# aaa authentication dot1x default group radius
Switch(config)# aaa authorization network default group radius
Switch(config)# aaa accounting dot1x default start-stop group radius
Switch(config)# radius-server vsa send accounting
Switch(config)# radius-server vsa send authentication
Switch(config)# interface FastEthernet0/10
Switch(config-if)# switchport mode access
Switch(config-if)# authentication event fail retry 0 action authorize vlan 30
Switch(config-if)# authentication event no-response action authorize vlan 20
Switch(config-if)# authentication port-control auto
Switch(config-if)# mab eap
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# dot1x timeout tx-period 1
Switch(config-if)# spanning-tree portfast
Switch# !debug dot1x


Supplicant (Windows XP)

Copy cacert.pem and wxp.p12 to the windows xp client.
Rename cacert.pem to cacert.der.

C:\> net start "Wired Autoconfig"
C:\> mmc
File > Add/Remove Snap-in... > Add > Certificates > Add > Computer account > Next > Finish > Close > OK
- Certifcates (Local Computer) > Personal > Certificates > All Tasks > Import... > wxp.p12 > key (MY_EXPORT)
- Certifcates (Local Computer) > Trusted Root Certification Authorities > Certificates > All Tasks > Import... > cacert.der
C:\> netsh lan export profile folder=C:\
C:\> type nic.xml
<?xml version="1.0"?>
<LANProfile xmlns="http://www.microsoft.com/networking/LAN/profile/v1">
        <MSM>
                <security>
                        <OneXEnforced>false</OneXEnforced>
                        <OneXEnabled>true</OneXEnabled>
                        <OneX xmlns="http://www.microsoft.com/networking/OneX/v1">
                                <cacheUserData>false</cacheUserData>
                                <authMode>machineOrUser</authMode>
                                <EAPConfig><EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><ConfigBlob>020000002A0000001D0000001400000037689DD23A688A3C5CFF726F9407DC30F999752F000001000000</ConfigBlob></EapHostConfig></EAPConfig>
                        </OneX>
                </security>
        </MSM>
</LANProfile>
Change 'machineOrUser' for 'machine'.
C:\> netsh lan add profile filename=nic.xml
NIC > Properties > Authentication
- Enable IEEE 802.1x authentication for this network
-- EAP type: Smart Card or other Certificate
-- Settings
--- Use a certificate on this computer > Use simple certificate selection
--- Validate server certificate
--- Trusted Root Certification Authorities > ca.lab.net


References

http://en.wikipedia.org/wiki/IEEE_802.1X
http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_1.99/Dot1X_Deployment/Dot1x_Dep_Guide.html

Posted by t0n1 0 comments
Labels: , , , , , ,

# Site-to-site IPsec VPN with certificates


Topology

[PC-1]----[ROUTER-1]----[ROUTER-2]----[PC-2]

[PC-1] eth0: 192.168.1.1/24

[ROUTER-1] fa0/1: 192.168.1.254/24
[ROUTER-1] fa0/0: 12.12.12.1/24

[ROUTER-2] fa0/0: 12.12.12.2/24
[ROUTER-2) fa0/1: 192.168.2.254/24

[PC-2] eth0: 192.168.2.1/24

Certificate signing request (CSR)

ROUTER-1# clock set 21:00:00 7 Oct 2012
ROUTER-1(config)# hostname router-1
router-1(config)# ip domain-name lab.net
router-1(config)# crypto pki trustpoint INCAWETRUST
router-1(ca-trustpoint)# enrollment terminal pem
router-1(ca-trustpoint)# fqdn router-1.lab.net
router-1(ca-trustpoint)# subject-name C=ES, ST=CAT, O=CAnet, OU=Engineering, CN=router-1.lab.net
router-1(ca-trustpoint)# revocation-check none
router-1(ca-trustpoint)# rsakeypair router-1.lab.net 1024
router-1(config)# crypto key zeroize rsa
router-1(config)# crypto key generate rsa general-keys label router-1.lab.net export modulus 1024
router-1(config)# crypto pki enroll INCAWETRUST
% Start certificate enrollment .. 

% The subject name in the certificate will include: C=ES, ST=CAT, O=CAnet, OU=Engineering, CN=router-1.lab.net
% The subject name in the certificate will include: router-1.lab.net
% Include the router serial number in the subject name? [yes/no]: no
% Include an IP address in the subject name? [no]: no
Display Certificate Request to terminal? [yes/no]: yes
Certificate Request follows:

-----BEGIN CERTIFICATE REQUEST-----
MIIB3jCCAUcCAQAwfTEZMBcGA1UEAxMQcm91dGVyLTEubGFiLm5ldDEUMBIGA1UE
CxMLRW5naW5lZXJpbmcxDjAMBgNVBAoTBUNBbmV0MQwwCgYDVQQIEwNDQVQxCzAJ
BgNVBAYTAkVTMR8wHQYJKoZIhvcNAQkCFhByb3V0ZXItMS5sYWIubmV0MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDJGnpad++Ll/2DdGumYJWYnBxT2uWySlq
/5RBhpKigyDWg/1WEBfxc92ImdKuz438GXoLW+r6SXwJkeszvsFuKqKNfdt5zC8y
ZCcAQzWhM6RL36UQKhRZXq+kBGGhDyTIDBx8hgOEuC9SnK6ACapvPmR2Y738TBSx
La005oVIUwIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAw
DQYJKoZIhvcNAQEEBQADgYEAeKhsFhdbcyX9CKEVxagQeF7bomWfc7YR04AMM0u1
t6iZJixHbADJQ1fa8LFjP/MbkRA2KwqHxtGN/D0uhyqE/vAfwslMV/Mm8l9c2iOC
HfzzV2bhQW9FpDcHyJSmmScINh1pZieczCiVAH+LGQVI2VkxY/CKEsqXUb2mQShZ
QlA=
-----END CERTIFICATE REQUEST-----

---End - This line not part of the certificate request---

Redisplay enrollment request? [yes/no]: no
ROUTER-2# clock set 21:02:00 7 Oct 2012
ROUTER-2(config)# hostname router-2
router-2(config)# ip domain-name lab.net
router-2(config)# crypto pki trustpoint INCAWETRUST
router-2(ca-trustpoint)# enrollment terminal pem
router-2(ca-trustpoint)# fqdn router-2.lab.net
router-2(ca-trustpoint)# subject-name C=ES, ST=CAT, O=CAnet, OU=Engineering, CN=router-2.lab.net
router-2(ca-trustpoint)# revocation-check none
router-2(ca-trustpoint)# rsakeypair router-2.lab.net 1024
router-2(ca-trustpoint)# crypto key generate rsa general-keys label router-2.lab.net export modulus 1024
router-2(config)# crypto pki enroll INCAWETRUST
% Start certificate enrollment .. 

% The subject name in the certificate will include: C=ES, ST=CAT, O=CAnet, OU=Engineering, CN=router-2.lab.net    
% The subject name in the certificate will include: router-2.lab.net
% Include the router serial number in the subject name? [yes/no]: no
% Include an IP address in the subject name? [no]: no
Display Certificate Request to terminal? [yes/no]: yes
Certificate Request follows:

-----BEGIN CERTIFICATE REQUEST-----
MIIB3jCCAUcCAQAwfTEZMBcGA1UEAxMQcm91dGVyLTIubGFiLm5ldDEUMBIGA1UE
CxMLRW5naW5lZXJpbmcxDjAMBgNVBAoTBUNBbmV0MQwwCgYDVQQIEwNDQVQxCzAJ
BgNVBAYTAkVTMR8wHQYJKoZIhvcNAQkCFhByb3V0ZXItMi5sYWIubmV0MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQCp+XYSYBFz1iBJEoXSvWjslMSmClPGULuu
VbOnKme8SkWUKbwUUKzP73nSSzMQy1bJqmRaNv2ZKBL/7fmRqUcEKL6mFLaz7i9w
hpUieO65QLEaW1O9skMuwZziwgzR/rbPx+AyZg/3qI6WLKm/NayDZK102fcFuD95
LCYx4AdwPQIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAw
DQYJKoZIhvcNAQEEBQADgYEAAmwl6OdFYzRzPmnFgeqC7unXOtpWNwccQs0CTAna
EdKu+dtGB3wEruGciASOTJZGX33Y+p4SmXdNDk50Bvpc8pqMveDuLbDASeeJmQqo
Wzjv6FZ3r+/qf1xJwSXVhsE4K53XOfaoU4Wb+DTyyHskyqU+GkcJujIa7wTNEoHK
Uf8=
-----END CERTIFICATE REQUEST-----

---End - This line not part of the certificate request---

Redisplay enrollment request? [yes/no]: no

CA configuration

LINUX-CA# mkdir /etc/ssl/CA
LINUX-CA# mkdir /etc/ssl/newcerts
LINUX-CA# echo '01' > /etc/ssl/CA/serial
LINUX-CA# touch /etc/ssl/CA/index.txt
LINUX-CA# cat /etc/ssl/openssl.cnf
...
[ CA_default ]

dir             = /etc/ssl
database        = $dir/CA/index.txt
certificate     = $dir/certs/cacert.pem
serial          = $dir/CA/serial
private_key     = $dir/private/cakey.pem
...
string_mask = default
...

LINUX-CA# openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650
Generating a 1024 bit RSA private key
...................++++++
................++++++
writing new private key to 'cakey.pem'
Enter PEM pass phrase:MY_SECRET
Verifying - Enter PEM pass phrase:MY_SECRET
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:ES
State or Province Name (full name) [Some-State]:CAT
Locality Name (eg, city) []:BCN
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CAnet
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:canet.lab.net
Email Address []:root@lab.net

LINUX-CA# mv cakey.pem /etc/ssl/private/.
LINUX-CA# mv cacert.pem /etc/ssl/certs/.
LINUX-CA# cat /etc/ssl/certs/cacert.pem
-----BEGIN CERTIFICATE-----
MIICqjCCAhOgAwIBAgIJANGQlt8Z5+XTMA0GCSqGSIb3DQEBBQUAMG4xCzAJBgNV
BAYTAkVTMQwwCgYDVQQIEwNDQVQxDDAKBgNVBAcTA0JDTjEOMAwGA1UEChMFQ0Fu
ZXQxFjAUBgNVBAMTDWNhbmV0LmxhYi5uZXQxGzAZBgkqhkiG9w0BCQEWDHJvb3RA
bGFiLm5ldDAeFw0xMjEwMDcxOTAzMjZaFw0yMjEwMDUxOTAzMjZaMG4xCzAJBgNV
BAYTAkVTMQwwCgYDVQQIEwNDQVQxDDAKBgNVBAcTA0JDTjEOMAwGA1UEChMFQ0Fu
ZXQxFjAUBgNVBAMTDWNhbmV0LmxhYi5uZXQxGzAZBgkqhkiG9w0BCQEWDHJvb3RA
bGFiLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1f6Y35sevFE14T33
5oRwMrCIZ8b6c2kLd1M9CqJqVlc0Ru37k/PLm4RmIy+d45JpL5GizuUn1XtAWI1N
/rdO8FrAKQ0SNNTRgT3MeJJX9iWbYcWj6atgntxxY5fLHszbXyohxnQieFjgq6oz
PuKXTEO3jIQhe+yZtg4fhbT/BN0CAwEAAaNQME4wHQYDVR0OBBYEFAV3rWlHkgVi
SgywgAlUCwqJL/3IMB8GA1UdIwQYMBaAFAV3rWlHkgViSgywgAlUCwqJL/3IMAwG
A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAxSnlrZhAMH0FmTMlXVGlzWa1
Rf/8Q8TJ+bA3Z6LwaaPQb/+9oAnF7MVsLnhbWd7XEyn1AM7qxgrlhFidRMKFnoJq
cEevAM2hBbsxaE1EA0eWycsM/z8rA4Flnp8IKo/Wds0+L64FqRDjTfsBfcbRiCem
Nsick9kDj2oiDw+f6mY=
-----END CERTIFICATE-----

Signing CSR

LINUX-CA# cat router-1.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIB3jCCAUcCAQAwfTEZMBcGA1UEAxMQcm91dGVyLTEubGFiLm5ldDEUMBIGA1UE
CxMLRW5naW5lZXJpbmcxDjAMBgNVBAoTBUNBbmV0MQwwCgYDVQQIEwNDQVQxCzAJ
BgNVBAYTAkVTMR8wHQYJKoZIhvcNAQkCFhByb3V0ZXItMS5sYWIubmV0MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDJGnpad++Ll/2DdGumYJWYnBxT2uWySlq
/5RBhpKigyDWg/1WEBfxc92ImdKuz438GXoLW+r6SXwJkeszvsFuKqKNfdt5zC8y
ZCcAQzWhM6RL36UQKhRZXq+kBGGhDyTIDBx8hgOEuC9SnK6ACapvPmR2Y738TBSx
La005oVIUwIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAw
DQYJKoZIhvcNAQEEBQADgYEAeKhsFhdbcyX9CKEVxagQeF7bomWfc7YR04AMM0u1
t6iZJixHbADJQ1fa8LFjP/MbkRA2KwqHxtGN/D0uhyqE/vAfwslMV/Mm8l9c2iOC
HfzzV2bhQW9FpDcHyJSmmScINh1pZieczCiVAH+LGQVI2VkxY/CKEsqXUb2mQShZ
QlA=
-----END CERTIFICATE REQUEST-----
LINUX-CA# openssl ca -in router-1.csr -config /etc/ssl/openssl.cnf
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for /etc/ssl/private/cakey.pem:MY_SECRET
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Oct  7 19:05:16 2012 GMT
            Not After : Oct  7 19:05:16 2013 GMT
        Subject:
            countryName               = ES
            stateOrProvinceName       = CAT
            organizationName          = CAnet
            organizationalUnitName    = Engineering
            commonName                = router-1.lab.net
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                81:DF:AB:0F:C0:6B:31:4B:08:5E:6D:86:11:26:9C:90:85:F5:83:8F
            X509v3 Authority Key Identifier: 
                keyid:05:77:AD:69:47:92:05:62:4A:0C:B0:80:09:54:0B:0A:89:2F:FD:C8

Certificate is to be certified until Oct  7 19:05:16 2013 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ES, ST=CAT, L=BCN, O=CAnet, CN=canet.lab.net/emailAddress=root@lab.net
        Validity
            Not Before: Oct  7 19:05:16 2012 GMT
            Not After : Oct  7 19:05:16 2013 GMT
        Subject: C=ES, ST=CAT, O=CAnet, OU=Engineering, CN=router-1.lab.net
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c3:24:69:e9:69:df:be:2e:5f:f6:0d:d1:ae:99:
                    82:56:62:70:71:4f:6b:96:c9:29:6a:ff:94:41:86:
                    92:a2:83:20:d6:83:fd:56:10:17:f1:73:dd:88:99:
                    d2:ae:cf:8d:fc:19:7a:0b:5b:ea:fa:49:7c:09:91:
                    eb:33:be:c1:6e:2a:a2:8d:7d:db:79:cc:2f:32:64:
                    27:00:43:35:a1:33:a4:4b:df:a5:10:2a:14:59:5e:
                    af:a4:04:61:a1:0f:24:c8:0c:1c:7c:86:03:84:b8:
                    2f:52:9c:ae:80:09:aa:6f:3e:64:76:63:bd:fc:4c:
                    14:b1:2d:ad:34:e6:85:48:53
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                81:DF:AB:0F:C0:6B:31:4B:08:5E:6D:86:11:26:9C:90:85:F5:83:8F
            X509v3 Authority Key Identifier: 
                keyid:05:77:AD:69:47:92:05:62:4A:0C:B0:80:09:54:0B:0A:89:2F:FD:C8

    Signature Algorithm: sha1WithRSAEncryption
         84:65:11:b5:db:df:f4:ce:d5:3c:d7:a4:d3:10:b8:cc:d5:c5:
         35:c3:7e:95:e6:d2:0b:e2:a9:0e:f6:b4:e7:a4:00:f4:0b:d2:
         04:a3:b1:bc:ba:44:4d:6a:a9:a2:f2:84:ea:5b:70:97:52:46:
         1b:fd:86:74:7f:75:88:50:6e:10:59:c5:20:84:a6:b4:8f:59:
         30:7f:8c:a7:7e:13:60:85:de:5a:a4:8f:ce:05:ba:7c:c6:84:
         fd:10:d0:86:c0:f3:b6:49:02:da:7b:9c:29:c8:8a:d9:7d:c3:
         d1:51:cd:0e:f4:b1:4a:2d:6c:26:16:06:ba:19:c2:79:8e:3f:
         e3:4e
-----BEGIN CERTIFICATE-----
MIICuzCCAiSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBuMQswCQYDVQQGEwJFUzEM
MAoGA1UECBMDQ0FUMQwwCgYDVQQHEwNCQ04xDjAMBgNVBAoTBUNBbmV0MRYwFAYD
VQQDEw1jYW5ldC5sYWIubmV0MRswGQYJKoZIhvcNAQkBFgxyb290QGxhYi5uZXQw
HhcNMTIxMDA3MTkwNTE2WhcNMTMxMDA3MTkwNTE2WjBcMQswCQYDVQQGEwJFUzEM
MAoGA1UECBMDQ0FUMQ4wDAYDVQQKEwVDQW5ldDEUMBIGA1UECxMLRW5naW5lZXJp
bmcxGTAXBgNVBAMTEHJvdXRlci0xLmxhYi5uZXQwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAMMkaelp374uX/YN0a6ZglZicHFPa5bJKWr/lEGGkqKDINaD/VYQ
F/Fz3YiZ0q7PjfwZegtb6vpJfAmR6zO+wW4qoo1923nMLzJkJwBDNaEzpEvfpRAq
FFler6QEYaEPJMgMHHyGA4S4L1KcroAJqm8+ZHZjvfxMFLEtrTTmhUhTAgMBAAGj
ezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVk
IENlcnRpZmljYXRlMB0GA1UdDgQWBBSB36sPwGsxSwhebYYRJpyQhfWDjzAfBgNV
HSMEGDAWgBQFd61pR5IFYkoMsIAJVAsKiS/9yDANBgkqhkiG9w0BAQUFAAOBgQCE
ZRG129/0ztU816TTELjM1cU1w36V5tIL4qkO9rTnpAD0C9IEo7G8ukRNaqmi8oTq
W3CXUkYb/YZ0f3WIUG4QWcUghKa0j1kwf4ynfhNghd5apI/OBbp8xoT9ENCGwPO2
SQLae5wpyIrZfcPRUc0O9LFKLWwmFga6GcJ5jj/jTg==
-----END CERTIFICATE-----
Data Base Updated

LINUX-CA# cat router-2.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIB3jCCAUcCAQAwfTEZMBcGA1UEAxMQcm91dGVyLTIubGFiLm5ldDEUMBIGA1UE
CxMLRW5naW5lZXJpbmcxDjAMBgNVBAoTBUNBbmV0MQwwCgYDVQQIEwNDQVQxCzAJ
BgNVBAYTAkVTMR8wHQYJKoZIhvcNAQkCFhByb3V0ZXItMi5sYWIubmV0MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQCp+XYSYBFz1iBJEoXSvWjslMSmClPGULuu
VbOnKme8SkWUKbwUUKzP73nSSzMQy1bJqmRaNv2ZKBL/7fmRqUcEKL6mFLaz7i9w
hpUieO65QLEaW1O9skMuwZziwgzR/rbPx+AyZg/3qI6WLKm/NayDZK102fcFuD95
LCYx4AdwPQIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAw
DQYJKoZIhvcNAQEEBQADgYEAAmwl6OdFYzRzPmnFgeqC7unXOtpWNwccQs0CTAna
EdKu+dtGB3wEruGciASOTJZGX33Y+p4SmXdNDk50Bvpc8pqMveDuLbDASeeJmQqo
Wzjv6FZ3r+/qf1xJwSXVhsE4K53XOfaoU4Wb+DTyyHskyqU+GkcJujIa7wTNEoHK
Uf8=
-----END CERTIFICATE REQUEST-----
LINUX-CA# openssl ca -in router-2.csr -config /etc/ssl/openssl.cnf
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for /etc/ssl/private/cakey.pem:MY_SECRET
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: Oct  7 19:06:24 2012 GMT
            Not After : Oct  7 19:06:24 2013 GMT
        Subject:
            countryName               = ES
            stateOrProvinceName       = CAT
            organizationName          = CAnet
            organizationalUnitName    = Engineering
            commonName                = router-2.lab.net
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                58:C3:3C:F3:1D:8C:D3:02:3A:83:AF:8B:C6:BD:7F:48:B8:54:3A:0A
            X509v3 Authority Key Identifier: 
                keyid:05:77:AD:69:47:92:05:62:4A:0C:B0:80:09:54:0B:0A:89:2F:FD:C8

Certificate is to be certified until Oct  7 19:06:24 2013 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ES, ST=CAT, L=BCN, O=CAnet, CN=canet.lab.net/emailAddress=root@lab.net
        Validity
            Not Before: Oct  7 19:06:24 2012 GMT
            Not After : Oct  7 19:06:24 2013 GMT
        Subject: C=ES, ST=CAT, O=CAnet, OU=Engineering, CN=router-2.lab.net
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:a9:f9:76:12:60:11:73:d6:20:49:12:85:d2:bd:
                    68:ec:94:c4:a6:0a:53:c6:50:bb:ae:55:b3:a7:2a:
                    67:bc:4a:45:94:29:bc:14:50:ac:cf:ef:79:d2:4b:
                    33:10:cb:56:c9:aa:64:5a:36:fd:99:28:12:ff:ed:
                    f9:91:a9:47:04:28:be:a6:14:b6:b3:ee:2f:70:86:
                    95:22:78:ee:b9:40:b1:1a:5b:53:bd:b2:43:2e:c1:
                    9c:e2:c2:0c:d1:fe:b6:cf:c7:e0:32:66:0f:f7:a8:
                    8e:96:2c:a9:bf:35:ac:83:64:ad:74:d9:f7:05:b8:
                    3f:79:2c:26:31:e0:07:70:3d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                58:C3:3C:F3:1D:8C:D3:02:3A:83:AF:8B:C6:BD:7F:48:B8:54:3A:0A
            X509v3 Authority Key Identifier: 
                keyid:05:77:AD:69:47:92:05:62:4A:0C:B0:80:09:54:0B:0A:89:2F:FD:C8

    Signature Algorithm: sha1WithRSAEncryption
         55:06:3f:87:2a:2b:a3:a4:e3:c9:c2:26:34:f5:e6:36:d0:52:
         08:41:4b:0c:34:48:b9:9e:2d:b6:ad:33:02:a3:2c:84:78:ed:
         a5:9c:f3:cf:1e:6b:6a:da:58:93:d4:22:25:91:37:44:5b:84:
         76:40:e4:b1:55:94:1d:70:55:ce:06:c3:7e:2d:0f:b7:51:63:
         fc:74:1f:e4:34:4f:38:45:16:8e:bd:fe:36:7b:c0:ba:97:ce:
         97:d5:0e:16:1b:a4:46:e1:a8:3a:5f:77:a7:9b:c4:3c:e5:78:
         58:d4:5f:f5:c6:91:05:5a:b5:2c:93:8b:c1:65:f3:45:6f:0f:
         7f:22
-----BEGIN CERTIFICATE-----
MIICuzCCAiSgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBuMQswCQYDVQQGEwJFUzEM
MAoGA1UECBMDQ0FUMQwwCgYDVQQHEwNCQ04xDjAMBgNVBAoTBUNBbmV0MRYwFAYD
VQQDEw1jYW5ldC5sYWIubmV0MRswGQYJKoZIhvcNAQkBFgxyb290QGxhYi5uZXQw
HhcNMTIxMDA3MTkwNjI0WhcNMTMxMDA3MTkwNjI0WjBcMQswCQYDVQQGEwJFUzEM
MAoGA1UECBMDQ0FUMQ4wDAYDVQQKEwVDQW5ldDEUMBIGA1UECxMLRW5naW5lZXJp
bmcxGTAXBgNVBAMTEHJvdXRlci0yLmxhYi5uZXQwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAKn5dhJgEXPWIEkShdK9aOyUxKYKU8ZQu65Vs6cqZ7xKRZQpvBRQ
rM/vedJLMxDLVsmqZFo2/ZkoEv/t+ZGpRwQovqYUtrPuL3CGlSJ47rlAsRpbU72y
Qy7BnOLCDNH+ts/H4DJmD/eojpYsqb81rINkrXTZ9wW4P3ksJjHgB3A9AgMBAAGj
ezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVk
IENlcnRpZmljYXRlMB0GA1UdDgQWBBRYwzzzHYzTAjqDr4vGvX9IuFQ6CjAfBgNV
HSMEGDAWgBQFd61pR5IFYkoMsIAJVAsKiS/9yDANBgkqhkiG9w0BAQUFAAOBgQBV
Bj+HKiujpOPJwiY09eY20FIIQUsMNEi5ni22rTMCoyyEeO2lnPPPHmtq2liT1CIl
kTdEW4R2QOSxVZQdcFXOBsN+LQ+3UWP8dB/kNE84RRaOvf42e8C6l86X1Q4WG6RG
4ag6X3enm8Q85XhY1F/1xpEFWrUsk4vBZfNFbw9/Ig==
-----END CERTIFICATE-----
Data Base Updated

LINUX-CA# ls -l /etc/ssl/newcerts
total 8
-rw-r--r-- 1 root root 3104 oct  7 21:05 01.pem
-rw-r--r-- 1 root root 3104 oct  7 21:06 02.pem

Importing CA certificate

router-1(config)# crypto pki authenticate INCAWETRUST

Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
MIICqjCCAhOgAwIBAgIJANGQlt8Z5+XTMA0GCSqGSIb3DQEBBQUAMG4xCzAJBgNV
BAYTAkVTMQwwCgYDVQQIEwNDQVQxDDAKBgNVBAcTA0JDTjEOMAwGA1UEChMFQ0Fu
ZXQxFjAUBgNVBAMTDWNhbmV0LmxhYi5uZXQxGzAZBgkqhkiG9w0BCQEWDHJvb3RA
bGFiLm5ldDAeFw0xMjEwMDcxOTAzMjZaFw0yMjEwMDUxOTAzMjZaMG4xCzAJBgNV
BAYTAkVTMQwwCgYDVQQIEwNDQVQxDDAKBgNVBAcTA0JDTjEOMAwGA1UEChMFQ0Fu
ZXQxFjAUBgNVBAMTDWNhbmV0LmxhYi5uZXQxGzAZBgkqhkiG9w0BCQEWDHJvb3RA
bGFiLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1f6Y35sevFE14T33
5oRwMrCIZ8b6c2kLd1M9CqJqVlc0Ru37k/PLm4RmIy+d45JpL5GizuUn1XtAWI1N
/rdO8FrAKQ0SNNTRgT3MeJJX9iWbYcWj6atgntxxY5fLHszbXyohxnQieFjgq6oz
PuKXTEO3jIQhe+yZtg4fhbT/BN0CAwEAAaNQME4wHQYDVR0OBBYEFAV3rWlHkgVi
SgywgAlUCwqJL/3IMB8GA1UdIwQYMBaAFAV3rWlHkgViSgywgAlUCwqJL/3IMAwG
A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAxSnlrZhAMH0FmTMlXVGlzWa1
Rf/8Q8TJ+bA3Z6LwaaPQb/+9oAnF7MVsLnhbWd7XEyn1AM7qxgrlhFidRMKFnoJq
cEevAM2hBbsxaE1EA0eWycsM/z8rA4Flnp8IKo/Wds0+L64FqRDjTfsBfcbRiCem
Nsick9kDj2oiDw+f6mY=
-----END CERTIFICATE-----

Certificate has the following attributes:
       Fingerprint MD5: B81F447E E0E17975 C95F9E27 10EA609E 
      Fingerprint SHA1: B373CB7E BF3CB28A 731A4142 C83C3770 95A8A98B 

% Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
% Certificate successfully imported
router-2(config)# crypto pki authenticate INCAWETRUST

Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
MIICqjCCAhOgAwIBAgIJANGQlt8Z5+XTMA0GCSqGSIb3DQEBBQUAMG4xCzAJBgNV
BAYTAkVTMQwwCgYDVQQIEwNDQVQxDDAKBgNVBAcTA0JDTjEOMAwGA1UEChMFQ0Fu
ZXQxFjAUBgNVBAMTDWNhbmV0LmxhYi5uZXQxGzAZBgkqhkiG9w0BCQEWDHJvb3RA
bGFiLm5ldDAeFw0xMjEwMDcxOTAzMjZaFw0yMjEwMDUxOTAzMjZaMG4xCzAJBgNV
BAYTAkVTMQwwCgYDVQQIEwNDQVQxDDAKBgNVBAcTA0JDTjEOMAwGA1UEChMFQ0Fu
ZXQxFjAUBgNVBAMTDWNhbmV0LmxhYi5uZXQxGzAZBgkqhkiG9w0BCQEWDHJvb3RA
bGFiLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1f6Y35sevFE14T33
5oRwMrCIZ8b6c2kLd1M9CqJqVlc0Ru37k/PLm4RmIy+d45JpL5GizuUn1XtAWI1N
/rdO8FrAKQ0SNNTRgT3MeJJX9iWbYcWj6atgntxxY5fLHszbXyohxnQieFjgq6oz
PuKXTEO3jIQhe+yZtg4fhbT/BN0CAwEAAaNQME4wHQYDVR0OBBYEFAV3rWlHkgVi
SgywgAlUCwqJL/3IMB8GA1UdIwQYMBaAFAV3rWlHkgViSgywgAlUCwqJL/3IMAwG
A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAxSnlrZhAMH0FmTMlXVGlzWa1
Rf/8Q8TJ+bA3Z6LwaaPQb/+9oAnF7MVsLnhbWd7XEyn1AM7qxgrlhFidRMKFnoJq
cEevAM2hBbsxaE1EA0eWycsM/z8rA4Flnp8IKo/Wds0+L64FqRDjTfsBfcbRiCem
Nsick9kDj2oiDw+f6mY=
-----END CERTIFICATE-----

Certificate has the following attributes:
       Fingerprint MD5: B81F447E E0E17975 C95F9E27 10EA609E 
      Fingerprint SHA1: B373CB7E BF3CB28A 731A4142 C83C3770 95A8A98B 

% Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
% Certificate successfully imported

Importing signed certificate

router-1(config)# crypto pki import INCAWETRUST certificate

Enter the base 64 encoded certificate.
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
MIICuzCCAiSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBuMQswCQYDVQQGEwJFUzEM
MAoGA1UECBMDQ0FUMQwwCgYDVQQHEwNCQ04xDjAMBgNVBAoTBUNBbmV0MRYwFAYD
VQQDEw1jYW5ldC5sYWIubmV0MRswGQYJKoZIhvcNAQkBFgxyb290QGxhYi5uZXQw
HhcNMTIxMDA3MTkwNTE2WhcNMTMxMDA3MTkwNTE2WjBcMQswCQYDVQQGEwJFUzEM
MAoGA1UECBMDQ0FUMQ4wDAYDVQQKEwVDQW5ldDEUMBIGA1UECxMLRW5naW5lZXJp
bmcxGTAXBgNVBAMTEHJvdXRlci0xLmxhYi5uZXQwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAMMkaelp374uX/YN0a6ZglZicHFPa5bJKWr/lEGGkqKDINaD/VYQ
F/Fz3YiZ0q7PjfwZegtb6vpJfAmR6zO+wW4qoo1923nMLzJkJwBDNaEzpEvfpRAq
FFler6QEYaEPJMgMHHyGA4S4L1KcroAJqm8+ZHZjvfxMFLEtrTTmhUhTAgMBAAGj
ezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVk
IENlcnRpZmljYXRlMB0GA1UdDgQWBBSB36sPwGsxSwhebYYRJpyQhfWDjzAfBgNV
HSMEGDAWgBQFd61pR5IFYkoMsIAJVAsKiS/9yDANBgkqhkiG9w0BAQUFAAOBgQCE
ZRG129/0ztU816TTELjM1cU1w36V5tIL4qkO9rTnpAD0C9IEo7G8ukRNaqmi8oTq
W3CXUkYb/YZ0f3WIUG4QWcUghKa0j1kwf4ynfhNghd5apI/OBbp8xoT9ENCGwPO2
SQLae5wpyIrZfcPRUc0O9LFKLWwmFga6GcJ5jj/jTg==
-----END CERTIFICATE-----

% Router Certificate successfully imported
router-2(config)# crypto pki import INCAWETRUST certificate

Enter the base 64 encoded certificate.
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
MIICuzCCAiSgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBuMQswCQYDVQQGEwJFUzEM
MAoGA1UECBMDQ0FUMQwwCgYDVQQHEwNCQ04xDjAMBgNVBAoTBUNBbmV0MRYwFAYD
VQQDEw1jYW5ldC5sYWIubmV0MRswGQYJKoZIhvcNAQkBFgxyb290QGxhYi5uZXQw
HhcNMTIxMDA3MTkwNjI0WhcNMTMxMDA3MTkwNjI0WjBcMQswCQYDVQQGEwJFUzEM
MAoGA1UECBMDQ0FUMQ4wDAYDVQQKEwVDQW5ldDEUMBIGA1UECxMLRW5naW5lZXJp
bmcxGTAXBgNVBAMTEHJvdXRlci0yLmxhYi5uZXQwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAKn5dhJgEXPWIEkShdK9aOyUxKYKU8ZQu65Vs6cqZ7xKRZQpvBRQ
rM/vedJLMxDLVsmqZFo2/ZkoEv/t+ZGpRwQovqYUtrPuL3CGlSJ47rlAsRpbU72y
Qy7BnOLCDNH+ts/H4DJmD/eojpYsqb81rINkrXTZ9wW4P3ksJjHgB3A9AgMBAAGj
ezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVk
IENlcnRpZmljYXRlMB0GA1UdDgQWBBRYwzzzHYzTAjqDr4vGvX9IuFQ6CjAfBgNV
HSMEGDAWgBQFd61pR5IFYkoMsIAJVAsKiS/9yDANBgkqhkiG9w0BAQUFAAOBgQBV
Bj+HKiujpOPJwiY09eY20FIIQUsMNEi5ni22rTMCoyyEeO2lnPPPHmtq2liT1CIl
kTdEW4R2QOSxVZQdcFXOBsN+LQ+3UWP8dB/kNE84RRaOvf42e8C6l86X1Q4WG6RG
4ag6X3enm8Q85XhY1F/1xpEFWrUsk4vBZfNFbw9/Ig==
-----END CERTIFICATE-----

% Router Certificate successfully imported

Configuring static crypto maps

router-1(config)# crypto isakmp policy 1
router-1(config-isakmp)# authentication rsa-sig
router-1(config-isakmp)# encryption aes
router-1(config-isakmp)# group 2
router-1(config-isakmp)# lifetime 86400
router-1(config)# crypto isakmp aggressive-mode disable
router-1(config)# crypto isakmp enable
router-1(config)# ip access-list extended CRYPTO_ACL
router-1(config-ext-nacl)# permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
router-1(config)# crypto ipsec transform-set TRANSFORM_SET esp-aes esp-sha-hmac
router-1(config)# crypto map CRYPTO_MAP 1 ipsec-isakmp
router-1(config-crypto-map)# set peer 12.12.12.2
router-1(config-crypto-map)# match address CRYPTO_ACL
router-1(config-crypto-map)# set transform-set TRANSFORM_SET
router-1(config-crypto-map)# set pfs group2
router-1(config)# interface fa0/0
router-1(config-if)# crypto map CRYPTO_MAP
router-1(config-if)# ip nat outside
router-1(config)# interface fa0/1
router-1(config-if)# ip nat inside
router-1(config)# ip route 192.168.2.0 255.255.255.0 12.12.12.2
router-1(config)# ip access-list extended ACL_NONAT
router-1(config-ext-nacl)# deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
router-1(config-ext-nacl)# permit ip any any
router-1(config)# ip nat inside source list ACL_NONAT interface fa0/0 overload
router-2(config)# crypto isakmp policy 1
router-2(config-isakmp)# authentication rsa-sig
router-2(config-isakmp)# encryption aes
router-2(config-isakmp)# hash sha
router-2(config-isakmp)# group 2
router-2(config-isakmp)# lifetime 86400
router-2(config)# crypto isakmp aggressive-mode disable
router-2(config)# crypto isakmp enable
router-2(config)# ip access-list extended CRYPTO_ACL
router-2(config-ext-nacl)# permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
router-2(config)# crypto ipsec transform-set TRANSFORM_SET esp-aes esp-sha-hmac
router-2(config)# crypto map CRYPTO_MAP 1 ipsec-isakmp
router-2(config-crypto-map)# set peer 12.12.12.1
router-2(config-crypto-map)# match address CRYPTO_ACL
router-2(config-crypto-map)# set transform-set TRANSFORM_SET
router-2(config-crypto-map)# set pfs group2
router-2(config)# interface fa0/0
router-2(config-if)# crypto map CRYPTO_MAP
router-2(config-if)# ip nat outside
router-2(config)# interface fa0/1
router-2(config-if)# ip nat inside
router-2(config)# ip route 192.168.1.0 255.255.255.0 12.12.12.1
router-2(config)# ip access-list extended ACL_NONAT
router-2(config-ext-nacl)# deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
router-2(config-ext-nacl)# permit ip any any
router-2(config)# ip nat inside source list ACL_NONAT interface fa0/0 overload
Posted by t0n1 0 comments
Labels: , , , , , , , , , ,
Subscribe to: Posts (Atom)