Μετάβαση στο κύριο περιεχόμενο

The reality and the future of software engineering

Δημοσίευση σχολίου

Handling Certificates: Private Keys, CSRs, Certificates, PFX/PKCS12 Format

A common issue when integrating components accross the boundaries of an organization (or sometimes even within) is the utilization of certificates for improving the security of the machine-to-machine communication. More specifically, certificates and cryptography can be used to mitigate man-in-the-middle risks as well as provide a framework for authentication (client-side certificates). In this post, I will use OpenSSL, which is an open source tool, to demonstrate how:
  1. to create a private key
  2. to create and sign a CSR (Certificate Signing Request)
  3. to bundle certificates and private key in PFX/PKCS12 files
The above steps are typically applied when client authentication is performed with a client-side certificate. In a nutshell, the service consumer needs to provide a CSR signed with her private key (either independently created (1), or created along the CSR creation (3)). Then the consumer sends the CSR to the provider who typically serves as a CA and creates a certificate for the provided CSR (typically a .crt file). The certificate file is returned to the consumer and it is usually bundled with the private key (and probably other certificates in its certificate chain) in a PFX/PKCS12 file (3), so that application servers and runtimes can use them. (In a subsequent post I plan to demonstrate how such certificates can be installed to a Windows machine in order to be used by browsers or custom applications.)
So if you are the service consumer of a similar situation keep reading.


First of all, a copy of OpenSSL needs to be downloaded and installed. For Linux users, OpenSSL is typically installed but if not you can easily download and install it from OpenSSL.org. For Windows users, you can download from here, selecting one of the available choices. Then, you may want to add the path of openssl.exe to your %PATH%. Finally, you can start using it though the command prompt.

1. Creating a Private Key

openssl genrsa -out private.key 2048

2. Creating and Signing a CSR

openssl req -new -sha256 -key private.key -out mycsr.csr

3. Bundling Certificates and Private Key into a PFX/PKCS12 file

openssl pkcs12 -export -out certs.pfx -inkey private.key -in mycert.crt -certfile CA.crt
Ετικέτες

Σχόλια

Δημοσίευση σχολίου

Δημοφιλείς αναρτήσεις από αυτό το ιστολόγιο

Counting Words, Characters and Lines with Notepad++

One of the best text editors in Windows is Notepad++ as it is lightweight, it provides a wealth of useful functionality –let alone the possible extensions through plugins. File Summary A useful feature of Notepad++ is that you can easily get a view on the size metrics of the document you are currently working on (characters, words, lines, etc). However, the menu is not that intuitive on finding that capability. So in order to get the above values you should go to: View >> Summary… The summary contains the following: Full path Created Modified File length (in byte) Characters (without blanks) Words Lines Current document length Selected Area Summary Nevertheless, the above summary provides file-level statistics and it may only provide the number of bytes and characters of a selected area. In order to count the word, characters, lines, etc. for just a selected part of the file you can install and use the TextFX Character plugin through the...
2 σχόλια
Διαβάστε περισσότερα

Creating a user registry - design and development tips based on modern guidelines and standards [Part 1: Introduction]

Sooner or later, it is almost inevitable that a software engineer comes across the challenge of creating a user registry to store users, user attributes, user credentials and authentication / authorization activities. It is a very common need since most applications, especially  Web and mobile  ones,  require such functionality, however there are quite a few pi tfalls in building a secure registry that will resist external and internal attacks. And it will attract attackers since it is one of the most critical component  of an application / platform  were sensitive data are stored. Nowadays, there are offerings by cloud providers to create your user registry on their platforms or use OAuth to accept users from other applications, instead of storing their credentials in your premises. Also, there are of course, COTS solutions to run on-premises. Such solutions are definitely a valid way to avoid a significant number of concerns that you have when you build a...
Δημοσίευση σχολίου
Διαβάστε περισσότερα

State Management in Stateless Web Applications: Basics

The proliferation of REST and statelessness in Web Application and Web API design, state management often becomes a matter of misunderstandings and conflict in development teams. Programmers of back-end systems may be used to assume that session-related state is preserved server side and may be referred to as needed by the application code. However, stateful implementations may suffer from performance and scalability limitations, making thus the stateless approach a viable alternative, especially when high-load Web-based systems are considered. How to pass data between requests in state-less / session-less Web applications The problem here is that there are cases in state-less Web applications where data from an interaction may be required in subsequent interactions to be processed by the server, even though they are not stored in the server in some form. In this case, you will have to let the Web client provide these data as context (or state) of subsequent interactions. ...
1 σχόλιο
Διαβάστε περισσότερα