Wiki de grifon

Cette page est en lecture seule. Vous pouvez afficher le texte source, mais ne pourrez pas le modifier. Contactez votre administrateur si vous pensez qu'il s'agit d'une erreur.
# CA - Interne

## Root CA
```
openssl genrsa -aes256 -out rootCA.key 4096
openssl req -new -subj "/C=FR/ST=Ille-et-Vilaine/L=Rennes/O=GRIFON/CN=ca.grif/emailAddress=contact@grifon.fr" -key rootCA.key -out rootCA.csr
openssl req -x509 -in rootCA.csr -key rootCA.key -sha512 -days 3650 -out rootCA.crt
openssl x509 -in rootCA.crt -noout -serial > rootCA.srl
```

Certif à importer : https://rda.grif/rootCA.crt

## Client Cert

Script dispo ici **/srv/internal\_ca/generate\_cert.sh** : 

```
#!/usr/bin/env bash
if [ "$#" -ne 1 ]; then
  echo "Usage: $0 DIRECTORY" >&2
  exit 1
fi

FQDN=$1

ROOT=$(pwd)
ROOT_CRT="${ROOT}/rootCA.crt"
ROOT_KEY="${ROOT}/rootCA.key"
ROOT_SRL="${ROOT}/rootCA.srl"
DEST_CERT="${ROOT}/services/${FQDN}"
VALIDATE="^([a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]\.)+[a-zA-Z]{2,}$"

if [ ! -d "${DEST_CERT}" ]; then
    mkdir -p ${DEST_CERT}
fi

if [[ "${FQDN}" =~ ${VALIDATE} ]]; then
    echo "Generate v3.ext_${FQDN}"
    echo "
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage               = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
issuerAltName          = issuer:copy
subjectAltName         = DNS:${FQDN}
" > v3.ext_${FQDN}

    echo "Valid fqdn, generate certificate for ${FQDN}"
    openssl genrsa -out ${DEST_CERT}/${FQDN}.key 4096
    chmod 0644 ${DEST_CERT}/${FQDN}.key
    openssl req -new -key "${DEST_CERT}/${FQDN}.key" \
            -sha512 \
            -subj "/C=FR/ST=Ille-et-Vilaine/L=Rennes/O=GRIFON/CN=${FQDN}/emailAddress=contact@grifon.fr" \
            -out "${DEST_CERT}/${FQDN}.csr"
    openssl x509 -days 365 -req -sha512 -in "${DEST_CERT}/${FQDN}.csr" -out "${DEST_CERT}/${FQDN}.crt" -CA "${ROOT_CRT}" -CAkey "${ROOT_KEY}" -CAcreateserial -CAserial "${ROOT_SRL}" -extfile v3.ext_${FQDN}

    cat ${DEST_CERT}/${FQDN}.crt ${ROOT_CRT} > ${DEST_CERT}/${FQDN}.chained.crt

    rm v3.ext_${FQDN}
else
    echo "Not a valid fqdn!"
    exit 1
fi
```

## Vhost delivery

Sur rda.grif, y a un vhost qui permet d'accéder aux certificats :
```
server {
    listen *:80;

    server_name           rda.grif;

    access_log /var/log/nginx/rootca.access.log;
    error_log /var/log/nginx/rootca.error.log;

    location / {
        try_files $uri @redirect;
    }

    location @redirect {
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name     rda.grif;

    if ($host = 'grif' ) {
            rewrite  ^/(.*)$  https://rda.grif/$1  permanent;
    }

    index  index.html index.htm index.php;
    access_log            /var/log/nginx/rootca.access.log combined;
    error_log             /var/log/nginx/rootca.error.log;

    include /usr/local/etc/nginx/ssl.conf;

    ssl_certificate /srv/internal_ca/services/rda.grif/rda.grif.chained.crt;
    ssl_certificate_key /srv/internal_ca/services/rda.grif/rda.grif.key;

    location / {
        root      /srv/internal_ca/;
        autoindex on;

        location ~\.key {
            allow 172.17.0.63; # web01.grif
            deny all;
        }

        location ~\.(sh|srl|csr)$ {
            deny all;   
        }
    }
}

```