Berikut adalah salah satu soal mengenai CA dan pembahasannya, silakan dicoba dan sesuikan dengan kondisi real sebenarnya pada saat kompetisi, karena mungkin di kota, provinsi atau soal nasional selanjutnya ada perubahan seperti kalimat, lokasi folder, nama server dan penamaan lainnya
Silakan sesuaikan nama file, nama domain, dll.
Certificate Authority
● Configure MAIL as Root CA.
1. openssl genrsa -out root.key 4096
○ Use Common Name: LKSN2022-Root
2. openssl req -new -x509 -days 1826 -key root.key -out root.crt
○ Approve Intermediate CA Requests for MON1 and MON2.
Jawaban ada di perintah 4 dan 6
○ Save those two Intermediate CA certificate files without the key in directory /backup in MAIL server.
Ini cukup kopikan file mon1.crt dan mon2.crt ke /backup
Bikin config untuk Intermediatte CA, bisa mencontoh di /etc/ssl/openssl.cnf juga.
Disini simple cukup membuat konfigurasi seperti dibawah ini buat file subca.cnf berisi:
[ req ]
extensions = v3_subca
req_extensions = v3_subca
[ v3_subca ]
basicConstraints = CA:TRUE
● Configure MON1 as Intermediate CA Issuer.
○ Use Common Name: LKSN2022-Intermediate-1
3. openssl genrsa -out mon1.key 4096
openssl req -new -key mon1.key -out mon1.csr
Penting isikan common name sesuai dengan perintah soal diatas
4. openssl x509 -extfile subca.conf -extensions v3_subca -req -days 1000 -in mon1.csr -CA RootCA.crt -CAkey RootCA.key -CAcreateserial -out mon1.crt
● Configure MON2 as Intermediate CA Issuer.
○ Use Common Name: LKSN2022-Intermediate-2
5. openssl genrsa -out mon2.key 4096
openssl req -new -key mon2.key -out mon2.csr
Penting isikan common name sesuai dengan perintah soal diatas
6. openssl x509 -extfile subca.conf -extensions v3_subca -req -days 1000 -in mon2.csr -CA root.crt -CAkey root.key -CAcreateserial -out mon2.crt
● In any of the Intermediate CA, issue the certificates required for other services.
○ For record, place all generated certificates in /backup/certs in MAIL server.
7. Generate Server Key & Csr for service like www, mail
Bikin balasan form dengan config berikut, isi file service.cnf:
[req]
default_bits = 4096
prompt = no
default_md = sha256
x509_extensions = req_ext
req_extensions = req_ext
distinguished_name = dn
[ dn ]
C=ID
ST=JKT
L=JKT
O=ITNSA
OU=ITNSA
emailAddress=me@itnsaskills.id
CN = *.itnsaskills.id
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = www
DNS.2 = www.itnsaskills.id
openssl genrsa -out service1.key 4096
openssl req -new -key service1.key -out service1.csr -config service.cnf
Check hasil
openssl req -in service1.csr -noout -text | grep DNS
output sesuai nama domain yg akan digunakan service
Sign the CSR dengan intermediette/Sub CA dengan mon1.crt
openssl x509 -req -in service1.csr -CA mon1.crt -CAkey mon1.key -CAcreateserial -out service1.crt -days 730 -extensions 'req_ext' -extfile service.cnf
Tambahan upload ca dan intermediette CA ke client browser
cat root.crt > ca-bundle1.crt
>> tambahkan dibawah file diatas
cat mon1.crt >> ca-bundle1.crt
cat root.crt > ca.bundle2.crt
cat mon2.crt >> ca.bundle2.crt
Hasil ketika mengakses browser, klik icon gembok di sebelah url bar, klik certificate / secure connection
Sekian terima kasih
Good Luck
Terima kasih dan semoga bermanfaat
Comments
Post a Comment