55 lines
3.0 KiB
Plaintext
55 lines
3.0 KiB
Plaintext
[SYNOPSYS]
|
|
make-ca -g
|
|
|
|
[EXAMPLES]
|
|
The make-ca script will process the certificates included in the certdata.txt
|
|
file, and place them in the system trust anchors, for use in multiple
|
|
certificate stores. Additionally, any local OpenSSL Trusted certificates
|
|
stored in /etc/ssl/local will also be imported into the system trust anchors
|
|
and certificate stores making it a full trust management utiltiy.
|
|
|
|
The make-ca script depends on OpenSSL >= 1.1.0, P11-Kit >= 0.23.19, and
|
|
optionally NSS >= 3.23 and Java >= 1.7. Additionally, Coreutils, gawk, and
|
|
sed are used. The default locations for output files can be tailored for
|
|
your environment via the /etc/make-ca.conf configuration file.
|
|
|
|
A p11-kit helper, copy-trust-modifications, is included for use in p11-kit's
|
|
trust-extract-compat script (which should be symlinked to the user's path as
|
|
update-ca-certificates). Manual creation of OpenSSL Trusted certificates is no
|
|
longer required for general use. Instead, import the certificate using
|
|
p11-kit's 'trust anchor --store /path/to/certificate.crt' functionality.
|
|
This will recreate the individual stores assigning approriate permissions to
|
|
the newly added anchor(s). Additionally, a copy of any newly added anchors will
|
|
be placed into $LOCALDIR for future use.
|
|
|
|
While the p11-kit trust utility can be used in most simple cases, you may
|
|
require additional trust arguments for certian certificates. In these cases,
|
|
you will need to manually create an OpenSSL trusted certificate from a regular
|
|
PEM encoded file (use -inform for der or pkcs7 encoded certs). There are three
|
|
trust types that are recognized by the make-ca.sh script, SSL/TLS, S/Mime, and
|
|
code signing. For example, using the CAcert root, if you want it to be trusted
|
|
for all three roles, the following commands will create an appropriate OpenSSL
|
|
Trusted certificate:
|
|
|
|
#\ install -vdm755 /etc/ssl/local \
|
|
#\ wget http://www.cacert.org/certs/root.crt \
|
|
#\ openssl x509 -in root.crt -text -fingerprint \\ \
|
|
-setalias "CAcert Class 1 root" \\ \
|
|
-addtrust serverAuth \\ \
|
|
-addtrust emailProtection \\ \
|
|
-addtrust codeSigning \\ \
|
|
> /etc/ssl/local/CAcert_Class_1_root.pem
|
|
|
|
If one of the three trust arguments is omitted, the certificate is neither
|
|
trusted, nor rejected for that role. Clients using GnuTLS without p11-kit
|
|
support are not aware of trusted certificates. To include this CA into the
|
|
ca-bundle.crt (used for GnuTLS linked applications not using the p11-module),
|
|
it must have serverAuth trust. Additionally, to explicitly disallow a
|
|
certificate for a particular use, replace the -addtrust flag with the
|
|
-addreject flag.
|
|
|
|
Local trust overrides are handled entirely using the /etc/ssl/local directory.
|
|
To override Mozilla's trust values, simply make a copy of the certificate in
|
|
the local directory with alternate trust values.
|
|
|