Pembahasan Soal CA LKS Nasional ITNSA 2022

 Berikut adalah salah satu soal mengenai CA dan pembahasannya, silakan dicoba dan sesuikan dengan kondisi real sebenarnya pada saat kompetisi, karena mungkin di kota, provinsi atau soal nasional selanjutnya ada perubahan seperti kalimat, lokasi folder, nama server dan penamaan lainnya

Silakan sesuaikan nama file, nama domain, dll.

Certificate Authority 

● Configure MAIL as Root CA. 

1. openssl genrsa -out root.key 4096

○ Use Common Name: LKSN2022-Root 

2. openssl req -new -x509 -days 1826 -key root.key -out root.crt

○ Approve Intermediate CA Requests for MON1 and MON2.

Jawaban ada di perintah 4 dan 6

 ○ Save those two Intermediate CA certificate files without the key in directory /backup in MAIL server. 

Ini cukup kopikan file mon1.crt dan mon2.crt ke /backup

Bikin config untuk Intermediatte CA, bisa mencontoh di /etc/ssl/openssl.cnf juga.

Disini simple cukup membuat konfigurasi seperti dibawah ini buat file subca.cnf berisi:

[ req ]

extensions    = v3_subca

req_extensions    = v3_subca

[ v3_subca ]

basicConstraints  = CA:TRUE

● Configure MON1 as Intermediate CA Issuer. 

○ Use Common Name: LKSN2022-Intermediate-1 

3.  openssl genrsa -out mon1.key 4096

openssl req -new -key mon1.key -out mon1.csr

Penting isikan common name sesuai dengan perintah soal diatas

4. openssl x509 -extfile subca.conf -extensions v3_subca -req -days 1000 -in mon1.csr -CA RootCA.crt -CAkey RootCA.key -CAcreateserial -out mon1.crt

● Configure MON2 as Intermediate CA Issuer.

 ○ Use Common Name: LKSN2022-Intermediate-2 

5. openssl genrsa -out mon2.key 4096

openssl req -new -key mon2.key -out mon2.csr

Penting isikan common name sesuai dengan perintah soal diatas

6. openssl x509 -extfile subca.conf -extensions v3_subca -req -days 1000 -in mon2.csr -CA root.crt -CAkey root.key -CAcreateserial -out mon2.crt

● In any of the Intermediate CA, issue the certificates required for other services.

 ○ For record, place all generated certificates in /backup/certs in MAIL server.

7. Generate Server Key & Csr  for service like www, mail

Bikin balasan form dengan config berikut, isi file service.cnf:

[req]

default_bits = 4096

prompt = no

default_md = sha256

x509_extensions = req_ext

req_extensions = req_ext

distinguished_name = dn

[ dn ]

C=ID

ST=JKT

L=JKT

O=ITNSA

OU=ITNSA

emailAddress=me@itnsaskills.id

CN = *.itnsaskills.id

[ req_ext ]

subjectAltName = @alt_names

[ alt_names ]

DNS.1 = www

DNS.2 = www.itnsaskills.id

openssl genrsa -out service1.key 4096

openssl req -new -key service1.key -out service1.csr -config service.cnf

Check hasil

openssl req -in service1.csr -noout -text | grep DNS

output sesuai nama domain yg akan digunakan service       

Sign the CSR dengan intermediette/Sub CA dengan mon1.crt

openssl x509 -req -in service1.csr -CA mon1.crt -CAkey mon1.key -CAcreateserial -out service1.crt -days 730 -extensions 'req_ext' -extfile service.cnf

Tambahan upload ca dan intermediette CA ke client browser

cat root.crt > ca-bundle1.crt

>> tambahkan dibawah file diatas

cat mon1.crt >> ca-bundle1.crt

cat root.crt > ca.bundle2.crt

cat mon2.crt >> ca.bundle2.crt

Hasil ketika mengakses browser, klik icon gembok di sebelah url bar, klik certificate / secure connection

Sekian terima kasih

Good Luck

Terima kasih dan semoga bermanfaat