Changes between Version 2 and Version 3 of SSL Certificate Management

Timestamp:

01/12/08 04:50:01 (18 years ago)

Author:

secrest@…

Comment:

--

SSL Certificate Management

@@ -103 +103 @@
 
 To sign a Certificate Signing Request, you need to gather the Certificate Signing Request file (mail.astro.columbia.edu.csr), the [wiki:"CAL Certificate Authority" CA Certificate] file (CAL-CA_root_cert.crt, which can be found in /usr/share/ca-certificates/cal/CAL-CA_root_cert.crt on any CW) and the CA Certificate key file (cacert.key) and its passphrase.  Switch into some working directory and place all those files there.  Then run the following commands:
-{{{mkdir demoCA
+{{{
+mkdir demoCA
 touch demoCA/index.txt
 echo "07" > demoCA/serial
@@ -121 +122 @@
 }}}
 That will create your new certificate, mail.astro.columbia.edu-cert.pem, good for one year, which you can install according to the directions in the Installing the Certificate section.
+
+=== Certificates Certified by the CAL CA ===
+
+==== terra.astro.columbia.edu ====
+
+This certificate is used for TLS connections to the LDAP server.
+{{{
+Server: terra
+Path to Certificate: /etc/ldap/slapd.cert
+Path to Key File: /etc/ldap/slapd.key
+Valid: 1/16/2007 21:21:35 GMT - 1/16/2008 21:21:35 GMT
+Serial Number: 0B
+Subject: DC=edu, DC=columbia, DC=astro, OU=services, CN=terra.astro.columbia.edu
+}}}
+
+==== mars.astro.columbia.edu ====
+
+This certificate is used for TLS connections to the LDAP server.
+{{{
+Server: mars
+Path to Certificate: /etc/ldap/slapd.cert
+Path to Key File: /etc/ldap/slapd.key
+Valid: 1/10/2007 03:00:24 GMT - 1/10/2008 03:00:24 GMT
+Serial Number: 09
+Subject: DC=edu, DC=columbia, DC=astro, OU=services, CN=mars.astro.columbia.edu
+}}}
+
+==== mail.astro.columbia.edu ====
+
+This certificate is used for SSL/TLS connections to the mail server and HTTPS connections to webmail.
+{{{
+Server: sedna
+Path to Certificate: /etc/ssl/certs/mail.astro.columbia.edu-cert.pem
+Path to Key File: /etc/ssl/private/mail.astro.columbia.edu.pem
+Valid: 7/11/2007 21:58:02 GMT - 7/10/2008 21:58:02 GMT
+Serial Number: 07
+Subject: C=US, ST=New York, O=Columbia University Astrophysics Laboratory, OU=services, CN=mail.astro.columbia.edu, E=security@astro.columbia.edu
+}}}
+
+==== docs.astro.columbia.edu ====
+
+This certificate is used for HTTPS connections to the wiki.
+{{{
+Server: uranus
+Path to Certificate: /etc/ssl/certs/docs.astro.columbia.edu-cert.pem
+Path to Key File: /etc/ssl/private/docs.astro.columbia.edu.pem
+Valid: 12/28/2006 19:52:26 GMT - 12/28/2007 19:52:26 GMT
+Serial Number: 08
+Subject: DC=edu, DC=columbia, DC=astro, OU=services, CN=docs.astro.columbia.edu
+}}}
+
+==== bee.astro.columbia.edu ====
+
+This certificate is used for HTTPS connections to the printer bee.
+{{{
+Server: bee
+Valid: 1/17/07 20:53:47 GMT - 1/17/08 20:53:47 GMT
+Serial Number: 0C
+Subject: CN=bee.astro.columbia.edu, L=New York, ST=New York, C=us, O=Columbia University, OU=0017088B3F32, OU=J7949E, OU=Astrophysics Laboratory
+}}}
+
+==== cricket.astro.columbia.edu ====
+
+This certificate is used for HTTPS connections to the printer cricket.
+{{{
+Server: cricket
+Valid: 8/17/2006 18:26:46 GMT - 8/17/2007 18:26:46 GMT
+Serial Number: 07
+Subject: CN=cricket.astro.columbia.edu, L=New York, ST=New York, C=US, O=Columbia University, OU=001438DB599E, OU=J7949E, OU=Astrophysics Laboratory
+}}}