C O N T E N T S

Using Certificates

How to create and distribute client certificates

Issuing client certificates means you are performing the role of a Certificate Authority with the purpose of requiring clients to use a certificate that you issue. The following steps are involved:

1. Using the Certificate Tool, create a certificate request (Option 3) and sign the certificate with your CA certificate (Option 6).

$ openssl pkcs12 -export -in <CLIENT_NAME>.CRT -

_$ inkey OPENSSL_KEY:<CLIENT_NAME>.KEY -

_$ out <CLIENT_NAME>.P12 -name "<Issuer Name>" -

_$ rand RANDFILE

Notes:

• The -rand parameter is required. If not specified, the resulting .P12 file will not be usable by Internet Explorer or Netscape Navigator. During import, the browser will pop up an error message with the text "password entered is incorrect" or similar error.
• The -out parameter should be a full file specification if you have not SET DEFAULT to the same directory as the .CRT file.

For example:

$ openssl pkcs12 -export -in JSAMPLE.CRT -
_$ inkey OPENSSL_KEY:JSample.KEY -

_$ out JSample.P12 -name "XYZCorp" -

_$ rand RANDFILE

Enter Export Password:

Verifying password - Enter Export Password:

The export password that you specify is required by the recipient of the certificate when installing it.

Convert to .DER for Internet Explorer

In the case of IE, you need to convert the .CRT file to .DER format by using the following command:

$ openssl x509 -in SERVER_CA.CRT -out SERVER_CA.DER -outform der

A client can receive a certificate by email, FTP, or directly using the browser. In the case of Internet Explorer (IE), having clients point directly to the files is the simplest way. This method may also be used with Netscape Navigator, but not with the advantage of automating the process.

If you use the browser method, copy the client certificate and the server certificate to your HTDOCS (or another accessible) directory. Clients can then point their browsers at the certificate files and save them. For example, the URLs could be:

http://test.res.xyz.corp/martian_client.p12
and
http://test.res.xyz.corp/server_ca.der

Important: In order to serve PKCS12 client certificates correctly to a Netscape users, you need to define this file type in HTTPD.CONF using the MOD_SSL.CONF include file.

In the case of IE, opening the save file will start the Certificate Manager Import Wizard automatically.

In the case of Netscape Navigator, users should load them using the Security Info window.

1. From the Communicator menu, choose Tools, and then choose Security Info.
   
2. From the Security Info window, click Certificates: Yours and then click Import a Certificate.

Important: Clients must load both the client certificate and the server certificates. The password you use when converting the certificates to PKCS12 format is required by clients to install the certificates.

How to use command-line OpenSSL

SSL-enabled HP Secure Web Server includes the complete OpenSSL command-line interface in its native UNIX format. Whether you will need to use this depends on the type of administrative tasks you plan to do. For example, if you are implementing client authentication, one requisite activity is to generate a Client Revocation List if you are issuing client certificates.

Start the OpenSSL command-line interface with this command:

$ @APACHE$COMMON:[OPENSSL.COM]OPENSSL_INIT_ENV.COM

Then enter the following, to choose a directive and proceed:

$ OPENSSL <commandname>

If you type an unknown command name, a complete list of commands (standard, message digest, and cipher) is displayed.

$ OPENSSL <unknown_commandname>

How to create and view a client revocation list

If you want to implement a client revocation list using the mod_SSL directives, SSLCARevocationPath and SSLCARevocationFile, you will need to set up your list using OpenSSL commands in the following way:

Revoke a certificate

When you revoke a certificate, you specify a client certificate you have issued. Doing so denies authorized access. The syntax of this command is as follows:

 $ openssl ca -verbose -config openssl_ca.conf -
_$ revoke <FILESPEC>.CRT

Example:

$ openssl ca -verbose -config openssl_ca.conf -
_$ revoke APACHE$COMMON:[OPENSSL.CRT]JAY_SAMPLE.CRT
Using configuration from openssl_ca.conf
Enter PEM pass phrase:

[List of Certificates]

Revoking Certificate 06.
Data Base Updated
$

The files specified are the CA configuration file (OPENSSL_CA.CONF), and the CRT file APACHE$COMMON:[OPENSSL.CRT]JAY_SAMPLE.CRT.

Create the client revocation list

When you create a CRL file, you are bundling all the revoked client certificate requests on your system. The syntax of this command is as follows:

 $ openssl ca -gencrl -config openssl_ca.conf -out -
_$ <FILESPEC>.CRL -crldays [365]

Notes:

• OpenSSL arguments (shown lowercase) may precede or follow OpenVMS file specifications (shown uppercase).
• If you do not have default_crl_days defined in your OPENSSL_CA.CONF file, you must supply this on the command line also (as in the following example).
• If you get an error message "Unable to load 'random state'," you can create a RANDFILE environment variable, as follows: