51.21. Setting Up a Certificate Authority

As Chapter 52 explains, the Webmin Users module can be used to request a client-side SSL certificate for a user. Before this is possible, however, you must set up your system as a certificate authority (CA). An authority is basically just an SSL certificate that can be used to sign other newly issued client certificates and to verify that those supplied by clients come from this CA.

Because client SSL authentication can only be used in SSL mode, Webmin must be running in that mode and thus have the openssl command installed before you can proceed. Once these requirements have been satisfied, follow these steps to set up a CA.

1.
Click on the Certificate Authority icon on the module's main page to bring up a form for entering the new CA's details.

2.
In the Authority name field, enter the name of the person issuing certificates, such as Network administrator.

3.
In the Email address field, enter the address of the administrator for this server, such as [email protected].

4.
In the Department field, enter the subdivision of your organization in which the server resides, such as Accounting. This can be left blank if it makes no sense, such as for a home server.

5.
In the Organization field, enter the name of your company or organization, such as Foo Corporation. Again, this may not make sense in all cases and so can be left blank.

6.
Fill in the State field with the name of the state in which your server resides, such as California.

7.
Fill in the Country code field with the two-letter, uppercase code for your country, such as AU.

8.
Click on the Setup certificate authority button to generate the CA certificate and configure Webmin to use it. If you have done this before, any existing certificate will be overwritten.

9.
Webmin users can now generate personal certificates using the Webmin Users module. Unfortunately, the web server will request that all clients supply a certificate as soon as one user has one, which can cause annoying dialog boxes to appear for people who are still set up for username and password authentication in some older browsers.

If you already have a CA in PEM format, with both the private key and certificate in one file, Webmin can be configured to use it instead of generating its own. Just go to the certificate authority page and paste it into the Edit CA certificate field, then hit Save.

To stop using a CA for validating clients altogether, hit the Shutdown certificate authority button on the same page. All users will be forced to revert to username and password authentication instead.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.221.140.111