Fun with Subject Alternative Names
[email protected] (John D. Ramsdell)
| Newsgroups | gmane.ietf.impp |
|---|---|
| Message-ID | <[email protected]> |
This note is aimed at helping you generate X.509 certificates with Subject Alternative Names so that you can experiment with authentication that includes a binding between a subject's identities, as given by its IM and PRES URI, and the subject's X.509 V3 Certificate. I have enclosed a script that works with OpenSSL 0.9.6g and generates a keystore for Kato, a dog that once chased geese on MITRE land. This script is a modification of a yet to be released version of a script used to generate certificates for SIMP. The SIMP script has been debugged and is known to work, however, it is possible I have introduced errors when I changed it for this group. The SIMP Service is written in Java, and the version of SIMP that uses Subject Alternative Names requires J2SE 1.4 or above. We discovered an interesting problem with V3 Certificates. Loading a Certificate with Subject Alternative Names that include opaque URIs, such as im:[email protected], causes an exception. For this reason, the script creates Subject Alternative Names that are server-based URIs, and then everything seems to work fine. John bash-2.01$ date Thu Aug 15 07:42:18 EDT 2002 bash-2.01$ uname -a Linux divan.mitre.org 2.4.2-2 #1 Sun Apr 8 20:41:30 EDT 2001 i686 unknown bash-2.01$ dir total 1 -rw-r--r-- 1 ramsdell air 524 Aug 15 07:30 goosedog.sh bash-2.01$ cat goosedog.sh #!/bin/sh set -x rm -rf demoCA rm -f *.pem rm -f *.p12 SAN=URI:im://[email protected],URI:pres://[email protected] export SAN sh CA.sh -newca <<EOF US MA Bedford The MITRE Corporation Test Certificate Authority EOF sh CA.sh -newreq <<EOF US MA Bedford The MITRE Corporation Kato the Goose Dog [email protected] EOF sh CA.sh -sign <<EOF y y EOF openssl x509 -in newcert.pem -noout -text openssl pkcs12 -export -out goosedog.p12 -in newcert.pem \ -inkey newreq.pem -name goosedog -certfile demoCA/cacert.pem bash-2.01$ pushd $OPENSSL_HOME /usr/local/ssl ~/cpim bash-2.01$ diff -u openssl__00.cnf openssl.cnf --- openssl__00.cnf Mon Aug 12 09:25:19 2002 +++ openssl.cnf Thu Aug 15 07:16:19 2002 @@ -180,6 +180,7 @@ # This stuff is for subjectAltName and issuerAltname. # Import the email address. # subjectAltName=email:copy +subjectAltName=${ENV::SAN} # Copy subject details # issuerAltName=issuer:copy bash-2.01$ popd ~/cpim bash-2.01$ cp -p $OPENSSL_HOME/misc/CA.sh . bash-2.01$ sh goosedog.sh + rm -rf demoCA + rm -f '*.pem' + rm -f '*.p12' + SAN=URI:im://[email protected],URI:pres://[email protected] + export SAN + sh CA.sh -newca CA certificate filename (or enter to create) Making CA certificate ... Using configuration from /usr/local/ssl/openssl.cnf Generating a 1024 bit RSA private key ................................................................++++++ .................................................++++++ writing new private key to './demoCA/private/./cakey.pem' Enter PEM pass phrase:kato Verifying password - Enter PEM pass phrase:kato ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, YOUR name) []:Email Address []:+ sh CA.sh -newreq Using configuration from /usr/local/ssl/openssl.cnf Generating a 1024 bit RSA private key .......++++++ ..................++++++ writing new private key to 'newreq.pem' Enter PEM pass phrase:kato Verifying password - Enter PEM pass phrase:kato ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, YOUR name) []:Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:An optional company name []:Request (and private key) is in newreq.pem + sh CA.sh -sign Using configuration from /usr/local/ssl/openssl.cnf Enter PEM pass phrase:kato Check that the request matches the signature Signature ok The Subjects Distinguished Name is as follows countryName :PRINTABLE:'US' stateOrProvinceName :PRINTABLE:'MA' localityName :PRINTABLE:'Bedford' organizationName :PRINTABLE:'The MITRE Corporation' commonName :PRINTABLE:'Kato the Goose Dog' emailAddress :IA5STRING:'[email protected]' Certificate is to be certified until Aug 15 11:43:51 2003 GMT (365 days) Sign the certificate? [y/n]: 1 out of 1 certificate requests certified, commit? [y/n]Write out database with 1 new entries Data Base Updated Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=MA, L=Bedford, O=The MITRE Corporation, OU=Test Certificate Authority Validity Not Before: Aug 15 11:43:51 2002 GMT Not After : Aug 15 11:43:51 2003 GMT Subject: C=US, ST=MA, L=Bedford, O=The MITRE Corporation, CN=Kato the Goose Dog/[email protected] Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d6:9e:0d:34:4e:b5:3f:76:a2:41:c4:fe:42:77: b8:f6:d3:0b:df:4b:80:41:05:f4:7a:54:43:21:a8: ee:21:9f:0b:0d:cc:6d:18:bc:10:f8:b2:07:dc:6f: 02:fc:c8:95:38:fb:43:8d:5f:58:c3:cb:81:64:91: ef:52:64:ab:18:5c:8d:a8:79:82:74:86:4d:7f:11: 1b:8e:82:48:58:97:f1:b3:1c:19:6b:67:ed:5f:35: 65:05:64:6d:74:e5:0c:42:1b:c5:82:94:62:ef:ab: c5:6d:0e:39:72:69:98:55:0a:3c:83:45:d6:08:1e: 1c:0f:da:5c:18:7a:bb:7f:ab Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 19:FD:70:C1:95:95:53:F3:F8:7F:E2:7B:6E:D6:F0:67:60:84:FA:ED X509v3 Authority Key Identifier: keyid:E1:6C:B0:4F:C0:65:DF:4B:49:D6:DE:68:03:6E:4A:85:93:84:23:A5 DirName:/C=US/ST=MA/L=Bedford/O=The MITRE Corporation/OU=Test Certificate Authority serial:00 X509v3 Subject Alternative Name: URI:im://[email protected], URI:pres://[email protected] Signature Algorithm: md5WithRSAEncryption 5d:e6:7e:71:02:0c:1d:6b:2c:e8:a0:72:c3:3d:ab:03:9c:7e: 7d:a0:98:da:39:6e:16:9c:cb:3f:7e:ae:75:99:75:99:a0:4b: 0a:41:bf:64:0a:ca:0e:1d:d5:99:b1:8b:81:26:c6:c6:ca:b1: e5:ce:48:14:a2:76:54:41:51:0f:c6:73:f2:fd:d0:41:9d:ab: 27:e1:28:ec:a1:b0:f1:a0:b6:70:0f:8b:2c:15:ed:4b:ea:6e: bc:4c:f3:37:ea:b0:0e:73:88:8c:a3:48:40:71:9f:dd:2c:1a: 97:8b:a1:13:7f:6e:3b:04:cd:09:fb:0a:c2:2e:8a:5e:e1:ad: 67:c1 -----BEGIN CERTIFICATE----- MIIDrzCCAxigAwIBAgIBATANBgkqhkiG9w0BAQQFADBxMQswCQYDVQQGEwJVUzEL MAkGA1UECBMCTUExEDAOBgNVBAcTB0JlZGZvcmQxHjAcBgNVBAoTFVRoZSBNSVRS RSBDb3Jwb3JhdGlvbjEjMCEGA1UECxMaVGVzdCBDZXJ0aWZpY2F0ZSBBdXRob3Jp dHkwHhcNMDIwODE1MTE0MzUxWhcNMDMwODE1MTE0MzUxWjCBjDELMAkGA1UEBhMC VVMxCzAJBgNVBAgTAk1BMRAwDgYDVQQHEwdCZWRmb3JkMR4wHAYDVQQKExVUaGUg TUlUUkUgQ29ycG9yYXRpb24xGzAZBgNVBAMTEkthdG8gdGhlIEdvb3NlIERvZzEh MB8GCSqGSIb3DQEJARYSZ29vc2Vkb2dAbWl0cmUub3JnMIGfMA0GCSqGSIb3DQEB AQUAA4GNADCBiQKBgQDWng00TrU/dqJBxP5Cd7j20wvfS4BBBfR6VEMhqO4hnwsN zG0YvBD4sgfcbwL8yJU4+0ONX1jDy4Fkke9SZKsYXI2oeYJ0hk1/ERuOgkhYl/Gz HBlrZ+1fNWUFZG105QxCG8WClGLvq8VtDjlyaZhVCjyDRdYIHhwP2lwYert/qwID AQABo4IBOTCCATUwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBH ZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFBn9cMGVlVPz+H/ie27W8Gdg hPrtMIGbBgNVHSMEgZMwgZCAFOFssE/AZd9LSdbeaANuSoWThCOloXWkczBxMQsw CQYDVQQGEwJVUzELMAkGA1UECBMCTUExEDAOBgNVBAcTB0JlZGZvcmQxHjAcBgNV BAoTFVRoZSBNSVRSRSBDb3Jwb3JhdGlvbjEjMCEGA1UECxMaVGVzdCBDZXJ0aWZp Y2F0ZSBBdXRob3JpdHmCAQAwPQYDVR0RBDYwNIYXaW06Ly9nb29zZWRvZ0BtaXRy ZS5vcmeGGXByZXM6Ly9nb29zZWRvZ0BtaXRyZS5vcmcwDQYJKoZIhvcNAQEEBQAD gYEAXeZ+cQIMHWss6KBywz2rA5x+faCY2jluFpzLP36udZl1maBLCkG/ZArKDh3V mbGLgSbGxsqx5c5IFKJ2VEFRD8Zz8v3QQZ2rJ+Eo7KGw8aC2cA+LLBXtS+puvEzz N+qwDnOIjKNIQHGf3Swal4uhE39uOwTNCfsKwi6KXuGtZ8E= -----END CERTIFICATE----- Signed certificate is in newcert.pem + openssl x509 -in newcert.pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=MA, L=Bedford, O=The MITRE Corporation, OU=Test Certificate Authority Validity Not Before: Aug 15 11:43:51 2002 GMT Not After : Aug 15 11:43:51 2003 GMT Subject: C=US, ST=MA, L=Bedford, O=The MITRE Corporation, CN=Kato the Goose Dog/[email protected] Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d6:9e:0d:34:4e:b5:3f:76:a2:41:c4:fe:42:77: b8:f6:d3:0b:df:4b:80:41:05:f4:7a:54:43:21:a8: ee:21:9f:0b:0d:cc:6d:18:bc:10:f8:b2:07:dc:6f: 02:fc:c8:95:38:fb:43:8d:5f:58:c3:cb:81:64:91: ef:52:64:ab:18:5c:8d:a8:79:82:74:86:4d:7f:11: 1b:8e:82:48:58:97:f1:b3:1c:19:6b:67:ed:5f:35: 65:05:64:6d:74:e5:0c:42:1b:c5:82:94:62:ef:ab: c5:6d:0e:39:72:69:98:55:0a:3c:83:45:d6:08:1e: 1c:0f:da:5c:18:7a:bb:7f:ab Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 19:FD:70:C1:95:95:53:F3:F8:7F:E2:7B:6E:D6:F0:67:60:84:FA:ED X509v3 Authority Key Identifier: keyid:E1:6C:B0:4F:C0:65:DF:4B:49:D6:DE:68:03:6E:4A:85:93:84:23:A5 DirName:/C=US/ST=MA/L=Bedford/O=The MITRE Corporation/OU=Test Certificate Authority serial:00 X509v3 Subject Alternative Name: URI:im://[email protected], URI:pres://[email protected] Signature Algorithm: md5WithRSAEncryption 5d:e6:7e:71:02:0c:1d:6b:2c:e8:a0:72:c3:3d:ab:03:9c:7e: 7d:a0:98:da:39:6e:16:9c:cb:3f:7e:ae:75:99:75:99:a0:4b: 0a:41:bf:64:0a:ca:0e:1d:d5:99:b1:8b:81:26:c6:c6:ca:b1: e5:ce:48:14:a2:76:54:41:51:0f:c6:73:f2:fd:d0:41:9d:ab: 27:e1:28:ec:a1:b0:f1:a0:b6:70:0f:8b:2c:15:ed:4b:ea:6e: bc:4c:f3:37:ea:b0:0e:73:88:8c:a3:48:40:71:9f:dd:2c:1a: 97:8b:a1:13:7f:6e:3b:04:cd:09:fb:0a:c2:2e:8a:5e:e1:ad: 67:c1 + openssl pkcs12 -export -out goosedog.p12 -in newcert.pem -inkey newreq.pem -name goosedog -certfile demoCA/cacert.pem Enter PEM pass phrase:kato Enter Export Password:kato Verifying password - Enter Export Password:kato bash-2.01$ dir total 15 -rwxr-xr-x 1 ramsdell air 3505 Aug 12 09:25 CA.sh drwxr-xr-x 6 ramsdell air 512 Aug 15 07:43 demoCA -rw-r--r-- 1 ramsdell air 2886 Aug 15 07:43 goosedog.p12 -rw-r--r-- 1 ramsdell air 524 Aug 15 07:30 goosedog.sh -rw-r--r-- 1 ramsdell air 3728 Aug 15 07:43 newcert.pem -rw-r--r-- 1 ramsdell air 1663 Aug 15 07:43 newreq.pem bash-2.01$ keytool -list -storetype pkcs12 -keystore goosedog.p12 Enter keystore password: kato Keystore type: pkcs12 Keystore provider: SunJSSE Your keystore contains 1 entry goosedog, Aug 15, 2002, keyEntry, Certificate fingerprint (MD5): 34:BE:E4:71:FA:37:B6:ED:9B:37:D1:38:2B:10:2B:90 bash-2.01$ [reminder: [email protected] for non-technical discussions, please]