SIRM_V2

markort2815@rs68:~$ cd ~
markort2815@rs68:~$ mkdir miniCA
markort2815@rs68:~$ cd miniCA/
markort2815@rs68:~/miniCA$ mkdir certs
markort2815@rs68:~/miniCA$ mkdir newcerts
markort2815@rs68:~/miniCA$ mkdir private
markort2815@rs68:~/miniCA$ mkdir crl
markort2815@rs68:~/miniCA$ touch index.txt
markort2815@rs68:~/miniCA$ touch serial
markort2815@rs68:~/miniCA$ nano serial //upisujemo 01
markort2815@rs68:~/miniCA$ touch crlnumber
markort2815@rs68:~/miniCA$ nano crlnumber //upisujemo 01
markort2815@rs68:~/miniCA$ ls
certs  crl  index.txt  newcerts  private serial crlnumber
markort2815@rs68:~/miniCA$ openssl genrsa -out private/cacert.key -des3 4096
Generating RSA private key, 4096 bit long modulus
........................................................................................................................++
.............................................................................................................................++
e is 65537 (0x10001)
Enter pass phrase for private/cacert.key: password
Verifying - Enter pass phrase for private/cacert.key: password
markort2815@rs68:~/miniCA$ openssl req -new -x509 -key private/cacert.key -out cacert.pem -config openssl.cnf -days 3650
Enter pass phrase for private/cacert.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Ime zemlje (Kod od 2 slova) [RS]:RS
Ime drzave ili provincije (puno ime) [Srbija]:Srbija
Ime lokacije (npr. grada) []:BG
Ime organizacije (npr. preduzece) [Super kompanija]:VISER
Ime organizacione jedinice unutar organizacije []:rt
Kratko ime, tzv. Common Name (tj. ime subjekta) []:miniCA //BITNO!!!
adresa elektronske poste []:[email protected]
markort2815@rs68:~/miniCA$ ls
cacert.pem  certs  crl	crlnumber  index.txt  newcerts	openssl.cnf  private  serial #cacer.pem!!

//UGAO KLIJENTA
markort2815@rs68:~$ mkdir ana
markort2815@rs68:~$ cd ana
markort2815@rs68:~/ana$ openssl genersa -out ana.key -des3 2048
Generating RSA private key, 2048 bit long modulus
........+++
.......+++
e is 65537 (0x10001)
Enter pass phrase for ana.key: password
Verifying - Enter pass phrase for ana.key: password
markort2815@rs68:~/ana$ cp ../miniCA/openssl.cnf .
Enter pass phrase for ana.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Ime zemlje (Kod od 2 slova) [RS]:RS
Ime drzave ili provincije (puno ime) [Srbija]:Srbija
Ime lokacije (npr. grada) []:BG
Ime organizacije (npr. preduzece) [Super kompanija]:VISER
Ime organizacione jedinice unutar organizacije []:RT
Kratko ime, tzv. Common Name (tj. ime subjekta) []:[email protected] //ide njen mejl
adresa elektronske poste []:[email protected]
markort2815@rs68:~/ana$ cp ana.csr ../miniCA
markort2815@rs68:~/ana$ cd ../miniCA/
//POTPISUJEMO SERTIFIKAT
markort2815@rs68:~/miniCA$ openssl ca -in ana.csr -config openssl.cnf -out certs/ana.pem
Using configuration from openssl.cnf
Enter pass phrase for /home/LABNET/markort2815/miniCA/private/cacert.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'RS'
stateOrProvinceName   :PRINTABLE:'Srbija'
localityName          :PRINTABLE:'BG'
organizationName      :PRINTABLE:'VISER'
organizationalUnitName:PRINTABLE:'RT'
commonName            :T61STRING:'[email protected]'
emailAddress          :IA5STRING:'[email protected]'
Certificate is to be certified until Mar 23 15:48:44 2019 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

markort2815@rs68:~/miniCA$ cp certs/ana.pem ../ana/
markort2815@rs68:~/miniCA$ cd ../ana/
markort2815@rs68:~/ana$ openssl pkcs12 -export -in ana.pem -inkey ana.key -name "Anin privatni kljuc i sertifikat" -out ana.p12
Enter pass phrase for ana.key:
Enter Export Password:	//SIFRA ZA ANU, onaj ko se ovoga dokopa moze da se predstavlja kao ana
Verifying - Enter Export Password:

//pokusavamo da potrvdimo da li anin sertivfikat vazi
markort2815@rs68:~$ rm -r bob //ukoliko vec postoji bob
markort2815@rs68:~$ mkdir bob
markort2815@rs68:~/bob$ cp ../ana/ana.pem .
markort2815@rs68:~/bob$ cp ../miniCA/cacert.pem .
markort2815@rs68:~/bob$ openssl verify ana.pem
ana.pem: C = RS, ST = Srbija, O = VISER, OU = RT, CN = [email protected], emailAddress = [email protected]
error 20 at 0 depth lookup:unable to get local issuer certificate //ne radi zato sto nemamo folder certs
markort2815@rs68:~/bob$ openssl verify -CAfile cacert.pem ana.pem
ana.pem: OK //sad radi
markort2815@rs68:~/bob$ openssl verify -CAfile cacert.pem -purpose sslclient ana.pem
ana.pem: C = RS, ST = Srbija, O = VISER, OU = RT, CN = [email protected], emailAddress = [email protected]
error 26 at 0 depth lookup:unsupported certificate purpose //ssl klijent verifikacija znaci da webserver autentifikuje nas!
OK //obicno na internetu mi autentifikujemo sajt a ne on nas
markort2815@rs68:~/bob$ openssl verify -CAfile cacert.pem -purpose sslserver ana.pem
ana.pem: OK //NEGDE JE GRESKA U .cnf FAJLU ANA NE SME DA BUDE OK!?!?!??!?