mia/bumper
1
0
Fork 0
Code Issues 47 Pull requests 11 Projects Releases Packages Wiki Activity Actions

run prettier

Browse source
This commit is contained in:
Robert Resch 2022-03-03 14:10:50 +01:00
parent 1e2d87efda
commit 2f7c7e1aa8
20 changed files with 227 additions and 218 deletions
Download patch file Download diff file Expand all files Collapse all files

72
docs/Create_Certs.md
View file

@ -1,31 +1,32 @@
# Creating Certs
Bumper requires specially crafted certificates to work properly. In the spirit of security, Bumper will not ship with default certificates. Users will need to generate and provide their own certificates.
Bumper requires specially crafted certificates to work properly. In the spirit of security, Bumper will not ship with default certificates. Users will need to generate and provide their own certificates.
Certificates should be placed in the `{bumper_home}/certs` directory. If certificates are located elsewhere [environment variables](Env_Var.md) can be set that point to their location.
Certificates should be placed in the `{bumper_home}/certs` directory. If certificates are located elsewhere [environment variables](Env_Var.md) can be set that point to their location.
Users can generate certificates in the following ways:
| Method | Description |
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| [OpenSSL](#manually-create-certs-with-openssl) | Users can manually create the same certificates as Create_Certs by utilizing OpenSSL. |
| [Custom CA/Self](#using-a-custom-caself) | If a user has their own CA the certificates can be generated there and used within Bumper. |
| Method | Description |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------ |
| [OpenSSL](#manually-create-certs-with-openssl) | Users can manually create the same certificates as Create_Certs by utilizing OpenSSL. |
| [Custom CA/Self](#using-a-custom-caself) | If a user has their own CA the certificates can be generated there and used within Bumper. |
**Certificate Requirements:**
* A CA Cert must be provided that can be imported into devices (phones, browsers, etc).
* Server certificate should include [SANs (Subject Alternate Names)](#subject-alternative-name) for all of the *.ecovacs, etc domains.
- A CA Cert must be provided that can be imported into devices (phones, browsers, etc).
- Server certificate should include [SANs (Subject Alternate Names)](#subject-alternative-name) for all of the \*.ecovacs, etc domains.
## Manually create certs with OpenSSL
The easiest way to create the required certs is at https://certificatetools.com/. In fact the below OpenSSL commands come straight from that site, post creation via the GUI.
The easiest way to create the required certs is at https://certificatetools.com/. In fact the below OpenSSL commands come straight from that site, post creation via the GUI.
### Create a Root CA
1. Create csrconfig_ca.txt for use in later commands
***csrconfig_ca.txt***
````
**_csrconfig_ca.txt_**
```
[ req ]
default_md = sha256
prompt = no
@ -37,12 +38,13 @@ organizationName = Bumper
[ req_ext ]
keyUsage=critical,keyCertSign,cRLSign
basicConstraints=critical,CA:true,pathlen:1
````
```
1. Create certconfig_ca.txt for use in later commands
***certconfig_ca.txt***
````
**_certconfig_ca.txt_**
```
[ req ]
default_md = sha256
prompt = no
@ -56,26 +58,27 @@ subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage=critical,keyCertSign,cRLSign
basicConstraints=critical,CA:true,pathlen:1
````
```
1. Generate the RSA private key
`openssl genrsa -out ca.key 4096`
1. Generate the RSA private key
`openssl genrsa -out ca.key 4096`
1. Create the CSR
`openssl req -new -nodes -key ca.key -config csrconfig_ca.txt -out ca.csr`
`openssl req -new -nodes -key ca.key -config csrconfig_ca.txt -out ca.csr`
1. Self-sign your CSR
`openssl req -x509 -nodes -in ca.csr -days 1095 -key ca.key -config certconfig_ca.txt -extensions req_ext -out ca.crt`
`openssl req -x509 -nodes -in ca.csr -days 1095 -key ca.key -config certconfig_ca.txt -extensions req_ext -out ca.crt`
### Create the Server Certificate
1. Create csrconfig_bumper.txt for use in later commands
***csrconfig_bumper.txt***
````
**_csrconfig_bumper.txt_**
```
[ req ]
default_md = sha256
prompt = no
@ -100,12 +103,13 @@ DNS.6 = *.ww.ecouser.net
DNS.7 = *.dc-eu.ww.ecouser.net
DNS.8 = *.dc.ww.ecouser.net
DNS.9 = *.area.ww.ecouser.net
````
```
1. Create certconfig_bumper.txt for use in later commands
***certconfig_bumper.txt***
````
**_certconfig_bumper.txt_**
```
[ req ]
default_md = sha256
prompt = no
@ -132,20 +136,20 @@ DNS.6 = *.ww.ecouser.net
DNS.7 = *.dc-eu.ww.ecouser.net
DNS.8 = *.dc.ww.ecouser.net
DNS.9 = *.area.ww.ecouser.net
````
```
1. Generate the RSA private key
`openssl genrsa -out bumper.key 4096`
`openssl genrsa -out bumper.key 4096`
1. Create the CSR
`openssl req -new -nodes -key bumper.key -config csrconfig_bumper.txt -out bumper.csr`
`openssl req -new -nodes -key bumper.key -config csrconfig_bumper.txt -out bumper.csr`
1. Sign your CSR with a root CA cert
`openssl x509 -req -in bumper.csr -days 365 -CA ca.crt -CAkey ca.key -extfile certconfig_bumper.txt -extensions req_ext -CAcreateserial -out bumper.crt`
`openssl x509 -req -in bumper.csr -days 365 -CA ca.crt -CAkey ca.key -extfile certconfig_bumper.txt -extensions req_ext -CAcreateserial -out bumper.crt`
## Using a Custom CA/Self
This should work siimilar to the OpenSSL method. Ensure the server certificate has the proper SANs (see above) in place.
This should work siimilar to the OpenSSL method. Ensure the server certificate has the proper SANs (see above) in place.