MESSAGE
| DATE | 2003-10-02 |
| FROM | Ruben Safir Secretary NYLXS
|
| SUBJECT | Subject: [hangout] [dennis.bieling@epigenomics.com: Re: [Users] key creation]
|
Hi Mark,
I'm not quite sure if I got your problem right,
but the procedures to create/install the needed keys/certificate
for a x509 patched freeswan are :
1. Generate a selfsigned Root CA, if you don't have one.
1.1. Generating the private key for the root CA:
openssl genrsa -des3 -out private/cakey.pem 2048
1.2. Generate the certificate and sign it with the private key:
openssl req -new -x509 -days 1460
-key private/cakey.pem -out cacert.pem
2. Create a certificate for the gateway machine:
2.1. Generating the private key:
openssl genrsa -des3
-out private/gatewayKey.pem 1024
2.2.Create the certificate request:
openssl req -new
-key private/gatewayKey.pem
-out gatewayReq.pem
2.3.Sign the request:
openssl ca -notext -in gatewayReq.pem
-out gatewayCert.pem
Out of historical reasons, you have to put the certificate also in a
binary form into /etc/x509cert.der:
openssl x509 -in gatewayCert.pem
-outform der -out /etc/x509cert.der
Now setup the /etc/ipsec.secrets file.
If you are using certificates, it is enough to just
enter the name for the private key and the passphrased
used to decode for example:
: RSA gatewayKey.pem "passphrase"
The last step will be to setup the /etc/ipsec.conf file matching your
connections and maybe some additional erouting.
That's all !
Best regards
Dennis
Mark Ireland-Spicer wrote:
>I have installed FreeSWAN from RPM on my RH8 system. When I ran 'verify'
>first time it failed on the RSA private key check. I subsequently followed
>the process for creating such, however, when I retry the verify it still
>fails.
>
>Any thoughts, please?
>
>Is it necessary to use a real FQDN in the creation of the key , eg does
>FreeSWAN check this? Is it possible to use .localhost as the
>FQDN?
>
>Thanks in advance
>
>Mark Ireland-Spicer
>
>This e-mail and any attachment is for authorised use by the intended
>recipient(s) only. It may contain proprietary material, confidential
>information and/or be subject to legal privilege. It should not be copied,
>disclosed to, retained or used by, any other party. If you are not an
>intended recipient then please promptly delete this e-mail and any
>attachment and all copies and inform the sender. Thank you.
>
>LogicaCMG global sponsors, Gartner Symposium, Cannes, 4th -7th November 2003
>
>http://symposium.gartner.com/story.php.id.3323.s.5.html
>
>Please note that LogicaCMG does not have control over content from,or
>availability of, this website
>_______________________________________________
>FreeS/WAN Users mailing list
>users-at-lists.freeswan.org
>https://mj2.freeswan.org/cgi-bin/mj_wwwusr
>
>_______________________________________________
>sfs-users mailing list
>sfs-users-at-lists.freeswan.ca
>http://lists.freeswan.ca/mailman/listinfo/sfs-users
>Sponsored by Astaro - http://www.astaro.com
_______________________________________________
FreeS/WAN Users mailing list
users-at-lists.freeswan.org
https://mj2.freeswan.org/cgi-bin/mj_wwwusr
----- End forwarded message -----
--
__________________________
Brooklyn Linux Solutions
__________________________
DRM is THEFT - We are the STAKEHOLDERS http://fairuse.nylxs.com
http://www.mrbrklyn.com - Consulting
http://www.inns.net <-- Happy Clients
http://www.nylxs.com - Leadership Development in Free Software
http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and articles from around the net
http://www2.mrbrklyn.com/downtown.html - See the New Downtown Brooklyn....
1-718-382-0585
____________________________
NYLXS: New Yorker Free Software Users Scene
Fair Use -
because it's either fair use or useless....
NYLXS is a trademark of NYLXS, Inc
|
|
