how to create a ca Certificate Authority in RHEL 6.x

-
  1. Change directory to the default CA directory:
    # cd /etc/pki/CA
  2. Create an index file for new certs:
    # touch index.txt
  3. Set first certificate number:
    # echo ’01′ > serial
    # echo ’01′ > crlnumber
  4. Create your CA cert and private key for your CA server:
    # openssl req -new -x509 -extensions v3_ca -keyout private/ca-cert.key -out certs/ca-cert.crt -days 365
    Enter PEM pass phrase: <your passpharse>
    Confirm PEM pass phrase: <your passpharse>
    Country Name: IN
    State: West bengal
    City: Kolkata
    Organization: Example
    Organizational Unit: Example
    Common Name: CA
    E-mail Address: [email protected]
  5. Set permissions on your private key:
    # chmod 400 private/ca-key.key
Now when you get a new certificate request, the following action need to perform to  generate a new cert signed by ca server :
  1. From your CA server, change directory to /etc/pki/CA
    # cd /etc/pki/CA
  2. Copy your certificate request to the /etc/pki/CA/crl directory
    # cp /root/ds1.csr /etc/pki/CA/crl
  3. Sign your cert using your CA
    # openssl ca -in crl/ds1.csr -out newcerts/ds1.pem -keyfile private/ca-cert.key -cert certs/ca-cert.crt
    Sign cert? y
    Commit? y

Comments

Post a Comment

Popular posts from this blog

using libguestfs virt-customize tool to modify qcow2 image and reset root password.

-
ibguestfs is a C library and a set of tools for accessing and modifying virtual disk images used in platform virtualization. The tools can be used for viewing and editing virtual machines managed by libvirt and files inside VMs, scripting changes to VMs, creating VMs, and much else beside. virt-customize is one of them as example. If you forgot root user password here is how you can modify . # virsh shutdown debian9-vm1 # virt-customize -a /var/lib/libvirt/images/debian9-vm1.qcow2 --root-password password:NewRootUserPasswordHere  not only this but you can edit many more. The –run-command option is used to execute any command inside a virtual image file. 1) register with rhel subscription virt-customize -a rhel-server-7.6.qcow2 --run-command 'subscription-manager attach --pool [subscription-pool]'     Install software or packages- virt-customize -a rhel-server-7.6.qcow2 --install net-tools  Upload a file into image virt-customize -a rhel-se...
Read more

Running cockpit behind nginx reverse proxy with nginx ssl and cockpit non ssl

-
Domain for web access to cockpit : cockpit.mylab.local cockpit server ip : 192.168.1.61 nginx server ip   : 192.168.1.65 Linux distro using is Centos 7.6 Login to cockpit server Create a file [root@repo ~]# vim /etc/cockpit/cockpit.conf content will be like [WebService] Origins = https://cockpit.mylab.local wss://cockpit.mylab.local ProtocolHeader = X-Forwarded-Proto AllowUnencrypted = true save and restart cockpit # systemctl restart cockpit now  login to your nginx webserver and install nginx # yum install nginx -y create a new file vim /etc/nginx/conf.d/cockpit.conf paste content as bellow server {     listen         80;     listen         443 ssl http2;     server_name    cockpit.mylab.local;     ssl_certificate /etc/ssl/certs/cockpit-selfsigned.crt;     ssl_certifica...
Read more

setting up openshift alert manager mail alerting based on critical and warning

-
Configure alert manager to send mail. This will send mail to 2 diffrent groups one is managemnet group for ciritical alerts only and second is default group for all alerts. $  oc project openshift-monitoring The secret file where alertmanager.yaml content ( encoded in base64 ) will remain is alertmanager-main convert the yaml content into base64 first $  cat alertmanager.yaml | base64 -w0 copy value now edit secret $ oc edit secret alertmanager-main find value starts with alertmanager.yaml: replace all base64 content from your own . save and exit now in order to take this secret in effect we must bounce the pod $  oc delete po -l alertmanager=main check if all pod came online $  oc get po -l alertmanager=main done! alertmanager.yaml content resolve_timeout : 5m route : group_wait : 30s group_interval : 5m repeat_interval : 12h ...
Read more