linuxexpert-practice-labs/labs/lpic-3-303/331-1-x509-and-pki

LPIC-3 331.1: X.509 certificates and public key infrastructures

A two-level CA with OpenSSL: a root, an intermediate run with openssl ca, a server certificate, a revocation and a CRL, other file formats, and CFSSL.

Before you start

The lab makes nothing but checks that /root/pki doesn't exist yet. Do everything as root, in /root/pki, with the file names the tasks give. Elliptic-curve P-256 keys without a passphrase are fine throughout.

Tasks

1. Make a root CA, root.key (mode 600) and the self-signed root.crt for /O=Lab/CN=Lab Root CA, valid for ten years, with basicConstraints critical CA:TRUE and keyUsage critical keyCertSign and cRLSign.
2. Make an intermediate CA, /O=Lab/CN=Lab Issuing CA, in int/: its key in int/private/int.key and its certificate int/int.crt, signed by the root and allowing no CAs below it (pathlen:0). Set up int/ for openssl ca with a configuration int/ca.cnf, a database int/index.txt and serial files starting at 1000.
3. Request a server certificate for /O=Lab/CN=www.lab.test with the names www.lab.test and lab.test (www.key, www.csr), and issue it from the intermediate with openssl ca as www.crt, for server authentication. Check that it verifies against the root only when the intermediate is supplied.
4. Revoke www.crt with reason keyCompromise, publish a CRL int.crl from the intermediate, and check that verification with the CRL now fails.
5. Save www.crt in DER form as www.der, and bundle the key, the certificate and the intermediate into www.p12 with the password lab-only.
6. Ubuntu: with CFSSL (package golang-cfssl), make a root CA Lab CFSSL Root (organization Lab) from a JSON request, written as cfssl-ca.pem and cfssl-ca-key.pem.

Hints

• openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -noenc -days ... -subj ... -addext ...; openssl x509 -noout -subject -issuer -ext basicConstraints,keyUsage.
• openssl x509 -req -CA root.crt -CAkey root.key -CAcreateserial -extfile; a [ ca ] section with dir, database, new_certs_dir, serial, crlnumber, certificate, private_key, policy and copy_extensions = copy.
• openssl req -new ... -addext subjectAltName=...; openssl ca -config int/ca.cnf -extensions ...; openssl verify -CAfile root.crt -untrusted int/int.crt www.crt.
• openssl ca -revoke ... -crl_reason, openssl ca -gencrl; openssl verify -crl_check -CAfile chain.pem -CRLfile int.crl.
• openssl x509 -outform DER; openssl pkcs12 -export -inkey -in -certfile -passout.
• cfssl gencert -initca ca.json | cfssljson -bare cfssl-ca; cfssl certinfo -cert.