Certificate Authority
I am working on better securing my server from all these attacks. So I decided I would recreate a root certificate authority and then an intermediate. My web sites use Godaddy certificates because they are accessed from the internet. Those certificates are on SSL Deep Inspection.
I created two servers called rootca.scsiraidguru.local and interca.scsiraidguru.local.
Building a Root CA and an Intermediate CA using OpenSSL and Debian Stretch
I followed the link above and build my two CAs and did the chains. I migrated both to p7b files for Windows to use. I added them into their respective certificate folders. Both certificates are OK. My next project is the certificate for MariaDB.
I created two servers rootca and interca. I fully patched both servers.
Sudo apt-get update
Sudo apt-get dist-upgrade
Edit /etc/hosts and supply ip, FQDN, and name for both servers on each one. Check hostname and hostname -f to make sure they are configured correctly. sudo reboot and autoclean/autoremove them.
Install ntp and configure it
sudo apt-get install ntp
/etc/ntp.conf
interface listen IPv4
server ntp.ubuntu.com
server 0.us.pool.ntp.org
server 1.us.pool.ntp.org
server 2.us.pool.ntp.org
server 3.us.pool.ntp.org
Remove the IPv6 entries.
sudo /etc/init.d/ntp restart or sudo reboot
ntpq -p
remote refid st t when poll reach delay offset jitter
==============================================================================
0.ubuntu.pool.n .POOL. 16 p – 64 0 0.000 0.000 0.000
1.ubuntu.pool.n .POOL. 16 p – 64 0 0.000 0.000 0.000
2.ubuntu.pool.n .POOL. 16 p – 64 0 0.000 0.000 0.000
3.ubuntu.pool.n .POOL. 16 p – 64 0 0.000 0.000 0.000
ntp.ubuntu.com .POOL. 16 p – 64 0 0.000 0.000 0.000
alphyn.canonica .INIT. 16 u – 1024 0 0.000 0.000 0.000
clock.trit.net .INIT. 16 u – 1024 0 0.000 0.000 0.000
eterna.binary.n .INIT. 16 u – 1024 0 0.000 0.000 0.000
tock.eoni.com .INIT. 16 u – 1024 0 0.000 0.000 0.000
138.68.46.177 ( .INIT. 16 u – 1024 0 0.000 0.000 0.000
ntpq -p refuses connection you have a conflict.
sudo systemctl show ntp.service | grep Conflicts
Conflicts=shutdown.target systemd-timesyncd.service
sudo systemctl status systemd-timesyncd.service
systemd-timesyncd.service – Network Time Synchronization
Loaded: loaded (/lib/systemd/system/systemd-timesyncd.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2019-07-12 05:17:21 UTC; 18min ago
dpkg -S /lib/systemd/system/systemd-timesyncd.service
systemd: /lib/systemd/system/systemd-timesyncd.service
sudo systemctl disable systemd-timesyncd.service
Removed /etc/systemd/system/sysinit.target.wants/systemd-timesyncd.service.
I usually sudo reboot
I started with the rootca server
# create root CA directory structure
mkdir /root/ca
cd /root/ca
mkdir newcerts certs crl private requests
touch index.txt
touch index.txt.attr
echo ‘1000’ > serial
# root ca key
openssl genrsa -aes256 -out private/ca.scsiraidguru.key.pem 4096
# root ca certificate
openssl req -config openssl_root.cnf -new -x509 -sha512 -extensions v3_ca -key /root/ca/private/ca.scsiraidguru.key.pem -out /root/ca/certs/ca.scsiraidguru.crt.pem -days 10950 -set_serial 0
Install Root CA cert on server
sudo mkdir /usr/share/ca-certificates/extra
sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt
convert to crt
openssl x509 -outform der -in foo.pem -out foo.crt
sudo dpkg-reconfigure ca-certificates
Create the Intermediate CA
Make sure you setup the FDQN, NTP first
# create the intermediate CA directory structure
mkdir /root/ca/intermediate
cd /root/ca/intermediate
mkdir certs newcerts crl csr private
touch index.txt
touch index.txt.attr
echo 1000 > /root/ca/intermediate/crlnumber
echo ‘1234’ > serial
Edit vim /usr/lib/ssl/openssl.cnf
On both servers. You will need to convert the pem files to crt files to import. See bottom of page.
# create the intermediate CA key and csr for intermediate certificate
openssl req -config /root/ca/intermediate/openssl_intermediate.cnf -new -newkey rsa:4096 -keyout /root/ca/intermediate/private/int.scsiraidguru.key.pem -out /root/ca/intermediate/csr/int.scsiraidguru.csr
# intermediate ca certificate
openssl ca -config /root/ca/openssl_root.cnf -extensions v3_intermediate_ca -days 10950 -notext -md sha512 -in /root/ca/intermediate/csr/int.scsiraidguru.csr -out /root/ca/intermediate/certs/int.scsiraidguru.crt.pem
