| 1 | | [[PageOutline]] |
| 2 | | = creating a PKCS12 certificate file = |
| 3 | | |
| 4 | | == prerequisites == |
| 5 | | |
| 6 | | This assumes you are running a reasonable operating system which has [http://www.openssl.org/ openssl] installed. This probably does not include [http://www.microsoft.com/ Windows]. |
| 7 | | |
| 8 | | == generating a private key and certificate request == |
| 9 | | |
| 10 | | Run the following command and provide reasonable answers to the questions it asks you: |
| 11 | | |
| 12 | | {{{ |
| 13 | | [dkg@squeak cal]$ openssl req -newkey rsa:2048 -keyout cal-key.pem -out cal-req.pem |
| 14 | | Generating a 2048 bit RSA private key |
| 15 | | .......................................................................................................................................................+++ |
| 16 | | ...........+++ |
| 17 | | writing new private key to 'cal-key.pem' |
| 18 | | Enter PEM pass phrase: |
| 19 | | Verifying - Enter PEM pass phrase: |
| 20 | | ----- |
| 21 | | You are about to be asked to enter information that will be incorporated |
| 22 | | into your certificate request. |
| 23 | | What you are about to enter is what is called a Distinguished Name or a DN. |
| 24 | | There are quite a few fields but you can leave some blank |
| 25 | | For some fields there will be a default value, |
| 26 | | If you enter '.', the field will be left blank. |
| 27 | | ----- |
| 28 | | Country Name (2 letter code) [AU]:US |
| 29 | | State or Province Name (full name) [Some-State]:New York |
| 30 | | Locality Name (eg, city) []:New York |
| 31 | | Organization Name (eg, company) [Internet Widgits Pty Ltd]:Columbia University Astrophysics Laboratory |
| 32 | | Organizational Unit Name (eg, section) []:People |
| 33 | | Common Name (eg, YOUR name) []:Daniel Kahn Gillmor |
| 34 | | Email Address []:foo@bar.com |
| 35 | | |
| 36 | | Please enter the following 'extra' attributes |
| 37 | | to be sent with your certificate request |
| 38 | | A challenge password []: |
| 39 | | An optional company name []: |
| 40 | | [dkg@squeak cal]$ |
| 41 | | }}} |
| 42 | | Now send the system administrator a copy of the new certificate request you just created called `cal-req.pem`, along with an explanation of why you should have an account. You're not done yet! All you've created so far is a key and a certificate request. The system administrator still needs to provide you with a full-fledged certificate. |
| 43 | | |
| 44 | | == creating the PKCS12 from the generated certificate == |
| 45 | | After receiving and verifying your certificate request, the system administrator will send you a file called `cal-cert.pem`. You should now run the following command: |
| 46 | | |
| 47 | | {{{ |
| 48 | | [dkg@squeak cal]$ openssl pkcs12 -export -in cal-cert.pem -inkey cal-key.pem -out cal-cert.p12 -name "My CAL Certificate" |
| 49 | | Enter pass phrase for dkg-cal-key.pem: |
| 50 | | Enter Export Password: |
| 51 | | Verifying - Enter Export Password: |
| 52 | | [dkg@squeak cal]$ |
| 53 | | }}} |
| 54 | | |
| 55 | | Now you have `cal-cert.p12`, which should be able to be loaded into your favorite web browser. |
| 56 | | |
| 57 | | = putting the certificate in different web browsers = |
| 58 | | |
| 59 | | == configuring Mozilla == |
| 60 | | Under Mozilla, choose "Edit|Preferences", then select "Privacy and Security" in the left-hand pane, and choose "Certificates" from the sub-menu. |
| 61 | | |
| 62 | | Click "Manage Certificates", ensure that the "Your Certificates" tab is active, and choose "import". Point Mozilla at `cal-cert.p12`, and give it the password you gave in the "Export Password" step above. Mozilla should now know how to identify you to the server. |
| 63 | | |
| 64 | | == configuring Firefox == |
| 65 | | Under firefox, choose "Edit", "Preferences", then under "Advanced", expand the "Certificates" section. Click "Manage Certificates". Ensure that the "Your Certificates" tab is active, and choose "import". Point Firefox at `cal-cert.p12`, and give it the password you gave in the "Export Password" step above. Firefox should now know how to identify you to the server. |
