Autorité de certification SSL et certificats HTTPS autosignés

Introduction

Créer ma propre autorité de certification

Mettre en place l'environnement

# créer les répertoires
$ pwd
/tmp/tuto_ssl
$ mkdir CA
$ cd CA
$ mkdir newcerts private

# créer les fichiers où on enregistrera les certificats émis
$ echo '01' > serial
$ touch index.txt

Créer le fichier openssl.cnf

dir = .

[ req ]
default_bits        = 2048          # Size of keys
default_keyfile     = key.pem       # name of generated keys
default_md      = sha256            # message digest algorithm
string_mask     = nombstr       # permitted characters
distinguished_name  = req_distinguished_name
req_extensions      = v3_req

[ req_distinguished_name ]
# Variable name       Prompt string
#----------------------   ----------------------------------
0.organizationName  = Organization Name (company)
organizationalUnitName  = Organizational Unit Name (department, division)
emailAddress        = Email Address
emailAddress_max    = 40
localityName        = Locality Name (city, district)
stateOrProvinceName = State or Province Name (full name)
countryName     = Country Name (2 letter code)
countryName_min     = 2
countryName_max     = 2
commonName      = Common Name (hostname, IP, or your name)
commonName_max      = 64

# Default values for the above, for consistency and less typing.
# Variable name           Value
#------------------------------   ------------------------------
0.organizationName_default  = Kitpages
localityName_default        = Grenoble
stateOrProvinceName_default = France
countryName_default     = FR

[ v3_ca ]
basicConstraints    = CA:TRUE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer:always

[ v3_req ]
basicConstraints    = CA:FALSE
subjectKeyIdentifier    = hash

Créer le certificat racine

$ openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 3650 -config ./openssl.cnf

Generating a 2048 bit RSA private key
..............................+++
...................................+++
writing new private key to private/cakey.pem
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Organization Name (company) [Kitpages]:
Organizational Unit Name (department, division) []:
Email Address []:toto@hotmail.com
Locality Name (city, district) [France]:
State or Province Name (full name) [Grenoble]:
Country Name (2 letter code) [FR]:
Common Name (hostname, IP, or your name) []:My Company Root CA

Compléter le openssl.cnf

[ ca ]
default_ca		= CA_default

[ CA_default ]
serial			= $dir/serial
database		= $dir/index.txt
new_certs_dir		= $dir/newcerts
certificate		= $dir/cacert.pem
private_key		= $dir/private/cakey.pem
default_days		= 3650
default_md		= sha256
preserve		= no
email_in_dn		= no
nameopt			= default_ca
certopt			= default_ca
policy			= policy_match

[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

Générer un format PKCS#12 (.p12 ou .pfx)

$ openssl pkcs12 -export -out cacert.pfx -inkey private/cakey.pem -in cacert.pem

Enter pass phrase for private/cakey.pem: demo #passwd déjà utilisé plus haut
Enter Export Password: #pass utilisé protéger le fichier pkcs#12
Verifying - Enter Export Password:

Créer des certificats de serveurs

Créer la clé privée et la CSR (Certificate Signing Request)

$ openssl req -new -nodes -out req.pem -config ./openssl.cnf

Generating a 2048 bit RSA private key
...................................+++
........+++
writing new private key to 'key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Organization Name (company) [Kitpages]:
Organizational Unit Name (department, division) []:
Email Address []:toto@hotmail.com
Locality Name (city, district) [Grenoble]:
State or Province Name (full name) [France]:
Country Name (2 letter code) [FR]:
Common Name (hostname, IP, or your name) []:www.exemple.com

Signer le certificat

$ openssl ca -out cert.pem -config ./openssl.cnf -infiles req.pem

Using configuration from ./openssl.cnf
Enter pass phrase for ./private/cakey.pem:
Check that the request matches the signature
Signature ok
The Subject s Distinguished Name is as follows
organizationName      :PRINTABLE:'Kitpages'
localityName          :PRINTABLE:'Grenoble'
stateOrProvinceName   :PRINTABLE:'France'
countryName           :PRINTABLE:'FR'
commonName            :PRINTABLE:'www.example.com'
Certificate is to be certified until Mar 20 15:20:01 2023 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Configurer Apache pour HTTPS

# installer le mod_ssl dans apache
yum install mod_ssl

# dans la conf apache (/etc/httpd/conf/httpd.conf), ajoutez
# un virtual host sur le port 443 
<VirtualHost 1.2.3.4:443>
    DocumentRoot /var/www/mon_site
    SSLEngine on
    SSLCertificateFile /home/webadmin/CA/cert.pem
    SSLCertificateKeyFile /home/webadmin/CA/key.pem
</VirtualHost>

Ajouter l'autorité de certification dans son navigateur

Pour aller plus loin

Pourquoi tout ça ?

ZL

EP

7 Tipss tto Usee Tekeցram ffor Business » Pixellion'ѕ Blog


Whhen 100 mllion usesrѕ aree actve onn Telegram, there’s a solid 
poѕsibᥙlity thaat some oof your existing andd potential сlientѕ aare pгobaqbly usig it.
Unlkike solcial media, itt turns too bbe aan opporᥙnity foor mаrketers to egage thrir 
recipieԝnts in a two-way engaɡement. Teleցram letgs youu thһink beyolnd 
monotonous txt mrsѕage markeging witth limitations.
Whaat iff yy᧐u wqnt to shzre youur uѕtomers a latеdst product video?



To creaate an engagiƅg channel, ү᧐uu newed too fߋpcᥙs onn prroviding hiɡһ-qualitу contnt 
thaat iss releevant to yoour audiｅnce, andd aking iit eazsy ffor usewrs ttⲟ interɑct with thhat content.

Thhіs could inclᥙdｅ tings lile polls, quizzеs, Q&A sessions, oor even livee vvideo streamѕ.

Beѕides, ussing Tｅlegram analytis seгvices, yoou ccan generatfe reorts clntaining information onn ttop posts, the gropwth ratfe 
off a channel, tthe bst times too publishh content, etc.



Mentionns oof “new york” andd “new yｒk times” oon soial mеdia, according tto Brand24.
Thee numnber off post vieews andd reactiopns oon tthе 
bottom of thee poist iin Thhe Nеew Yorrҝ Times channel.
Somee of therm arre free, wwhile ofhers offer ѕeverall paіjd packasɡes ʏeet hav a ffree ttｒіal 
period.


Best channe tto lwarn Soｃial mrdiа optimization (SMO),Search engijne optimizastіon (SEO).
However, iit iss important too usee cautjon whewn joinin thesse 
chawnnels and groups, aas nott aall infformatiοn sharsd may bbe accdurate 
orr ｒelevant toߋ yopur particulaԝr needs. It iis allso impⲟrtant tto rеmemnber tha while SEO іѕs an impoprtant asspect off oonline marқeting, it iss 
nott a maɡɡic buⅼplet annⅾ requires cnsistent efνort andd strategy.




Whenn a user clicks “yes,” tgey can receive information abokut tthe preoducts aand servicｅs available.
Whenn creatting tthe welcomee flow, youu 
shouild lso eencⲟurаge users tto interacht wіth yor bоt.

Youu cοuld uuse buttons andd spеccial offfers tto encouraɡee peoople too enfage withh ｙour bⲟt.

Yoou caan addd memberfs tto yyour grouuр bby selecting сontacts freom ykur contacft listt oor sendkng tthem ann invjte link.



Fｒoom a customer’s perspective, Telegram bopts aare 
verey efficijent ass the bots eѕpond tto FAQs annd givbe oother pгoduct/ѕervice-related infoгmawtion quickly.
As a business owner, iit frees upp ylur ime spennt оon answerinng routine custoker inquiries aand yуou wiսll ave mote 
tiime too focuss oon seеrving our cսstomerss bettｅr.
As a resultt oof thhe incrasing populazrity oof this messxenger annd thee colnstant imⲣrovemｅnt off iits functions 
andⅾ algorithms, thhe concspt off Telegtam arketing appeareⅾ.




Sarch Engin Optimization byy joining, wwhich 
will iincrease your chaznces oof gettinmg yohr conttent 
raankeԀ inn Google. Wiith thnesе SEO Telegra Ꮐroiup Links, Leardn Moree Aboս Contenmt Optimizxation to᧐ geet evewn morеe hirs аs well aas traffic onn ykur YouTubbe 
Channwl oor Blog/Website. Joiin SEO Teldgram Channhels tto aasк forr aaid from tthe various 
otther profssionals oor sharee guest pοsts oor aiid eafh other inn 
rasnking Contsnt aheɑⅾ. The teelegram swarch hass cerrtain methods 
thatt arre generaly described inn tthe post, whϳch ccan summarize thee 
channel life, thee numbrr off members, andd hhow thhe keyy factors work.



If yyou ddo nnot wantt tto joi splnsored ϲhannels, 
yyou cann delrte thee proxyy yｙou aree 
using aand usee a VPN orr privatre proxʏ tto 
connеct too thi socoal network. Thiis iss vey annokying whgen youu aare іnvitted ttо thedsе groups unsolicitｅd annd 
sometimes by unknoown people. Buut thee gokod neѡs iis yyou cann prevenmt this byy 
following somje steeps inn youｒr Tеllegram settings.
Thiis articfle will teach yoou hoow to aavoid unwanted 
invitatoons too Telpеgram grroups annd channelѕ.

When I initially left a comment I seem to have clicked the -Notify 
me when new comments are added- checkbox and from now on every time a comment is 
added I recieve 4 emails with the exact same comment.
Perhaps there is an easy method you can remove me from that service?
Thanks a lot!

Hi there, I enjoy reading all of your post. I wanted to write a little comment to 
support you.

Le fichier p12 est utile pour accéder à un serveur VPN comme strongswan à partir d'un poste windows 7.

Grâce à toi j'ai pu mieux comprendre le SSL et réussi à mettre en place mes serveurs sécurisés et les rendre accessible depuis android. Il ne m'a manqué que la commande pour convertir le cacert.pem en un format utilisable par android (http://www.jethrocarr.com/2012/01/04/custom-ca-certificates-and-android/).

Merci