Technical Notes

Using OpenSSL to Generate a Certificate Request and Configuring Certificate Authentication for F-Secure SSH Server for UNIX
Technical Note 1936
Last Reviewed 01-Dec-2005
Applies To
F-Secure SSH Server for UNIX version 5.x
Summary

You can use digital certificates to establish secure connections with PKI (Public Key Infrastructure). This technical note outlines how to create and obtain a certificate, import it to the server, and properly configure the server to use certificate authentication.

Overview of Certificate Authentication for Servers

Rather than using public keys to authenticate your session, you can use certificates that authenticate the server during the Diffie-Hellman key exchange:

1. The server sends its certificate to the client.
2. The client verifies the certificate was signed by a valid Certificate Authority (CA).
3. The client verifies that the certificate has the fully qualified domain name of the server.
4. The client uses the challenge command to verify the private key of the server.

To have fully-enabled certificate authentication, both the server and the client must be configured for certificate authentication. However you can opt for server-only or client-only certificate authentication, depending on the needs of your environment. This technical note explains how to configure the F-Secure server. For information about the F-Secure client configuration, see Technical Note 1931.

OpenSSL Example

The steps in this note reflect that OpenSSL on a UNIX server is used to generate the certificate request. You may, however, choose to use a different application to generate the certificate request.

Preliminary Steps

Before you obtain the server certificate, you must verify the server's fully qualified domain name (FQDN) and modify the openssl.cnf file.

Verify the Server Hostname

To verify the host FQDN, at the command line enter the command

It should display the FQDN, for example:

You will enter the FQDN in the subjectAltName in the openssl.cnf file. If the hostname command does not display the FQDN, please review your host documentation for further information.

Modify Openssl.cnf to Generate Certificate Request with FQDN

Prior to generating the server certificate, the openssl.cnf file must be modified to enable version three extensions for the certificate request. This modification enables you to enter the FQDN for the server, which is required for a successful connection.

1. Open the server file, openssl.cnf, for editing.
2. Locate the following line (commented by default) under the [ req ] section of openssl.cnf:

3. Uncomment the following line:

4. Locate the [ v3_req ] section of openssl.cnf and add the following line (replace myHost.myCo.com with the FQDN of your host):

5. Save the file and verify that the changes were made.

Obtain the Required Server Certificate

Follow the steps below to obtain the server certificate.

1. Generate the RSA private key (privkey) and pkcs10 request (request.pkcs10) with the command:

2. Send the resulting pkcs10 package (the request.pkcs10 file) to a Certificate Authority for signing. The package is an ASCII file that you can view in Notepad; it is simply a request for a certificate based on the key generated in step 1.

3. Obtain the root CA certificate from your Certificate Authority provider. This file must be in Base-64 encoded X.509 (CER) format. If you are unsure of its format, import the certificate to Internet Explorer’s certificate store and then export it as a Base-64 file.

Configure the Server to Use Certificate Authentication

Follow the steps below to configure the server to use certificate authentication.

1. On the server, create a folder under /etc/ssh2 called pki.
2. Upload the root CA certificate in binary format to the server folder /etc/ssh2/pki.
3. After you receive your CA-signed server certificate, upload it in binary format to the /etc/ssh2 folder. Depending on the CA used, the certificate may be in a "Base-64 encoded" or ".pem" format. Either format is acceptable.

4. Next, create the pkcs12 package from which the private key (in SSH2 format) and the CA-signed server certificate are extracted.

5. Now extract the private key (in SSH2 format) and server certificate with the command:

• Replace myPassword with the password you noted in step 1
• Do not assign a passphrase to the private key when prompted; leave it blank. If you assign a passphrase, the sshd daemon cannot restart.

6. Modify and add the following lines in the sshd2_config file:

7. Save the sshd2_config file.
8. Stop and restart the sshd2 daemon.

Related Technical Notes

1931	Using OpenSSL to Generate Certificate Requests and Configuring Certificate Authentication for F-Secure SSH Clients