155 lines
4.6 KiB
Markdown
155 lines
4.6 KiB
Markdown
# Creating Certs
|
|
|
|
Bumper requires specially crafted certificates to work properly. In the spirit of security, Bumper will not ship with default certificates. Users will need to generate and provide their own certificates.
|
|
|
|
Certificates should be placed in the `{bumper_home}/certs` directory. If certificates are located elsewhere [environment variables](Env_Var.md) can be set that point to their location.
|
|
|
|
Users can generate certificates in the following ways:
|
|
|
|
| Method | Description |
|
|
| ---------------------------------------------- | ------------------------------------------------------------------------------------------ |
|
|
| [OpenSSL](#manually-create-certs-with-openssl) | Users can manually create the same certificates as Create_Certs by utilizing OpenSSL. |
|
|
| [Custom CA/Self](#using-a-custom-caself) | If a user has their own CA the certificates can be generated there and used within Bumper. |
|
|
|
|
**Certificate Requirements:**
|
|
|
|
- A CA Cert must be provided that can be imported into devices (phones, browsers, etc).
|
|
- Server certificate should include [SANs (Subject Alternate Names)](#subject-alternative-name) for all of the \*.ecovacs, etc domains.
|
|
|
|
## Manually create certs with OpenSSL
|
|
|
|
The easiest way to create the required certs is at https://certificatetools.com/. In fact the below OpenSSL commands come straight from that site, post creation via the GUI.
|
|
|
|
### Create a Root CA
|
|
|
|
1. Create csrconfig_ca.txt for use in later commands
|
|
|
|
**_csrconfig_ca.txt_**
|
|
|
|
```
|
|
[ req ]
|
|
default_md = sha256
|
|
prompt = no
|
|
req_extensions = req_ext
|
|
distinguished_name = req_distinguished_name
|
|
[ req_distinguished_name ]
|
|
commonName = Bumper CA
|
|
organizationName = Bumper
|
|
[ req_ext ]
|
|
keyUsage=critical,keyCertSign,cRLSign
|
|
basicConstraints=critical,CA:true,pathlen:1
|
|
```
|
|
|
|
1. Create certconfig_ca.txt for use in later commands
|
|
|
|
**_certconfig_ca.txt_**
|
|
|
|
```
|
|
[ req ]
|
|
default_md = sha256
|
|
prompt = no
|
|
req_extensions = req_ext
|
|
distinguished_name = req_distinguished_name
|
|
[ req_distinguished_name ]
|
|
commonName = Bumper CA
|
|
organizationName = Bumper
|
|
[ req_ext ]
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always,issuer
|
|
keyUsage=critical,keyCertSign,cRLSign
|
|
basicConstraints=critical,CA:true,pathlen:1
|
|
```
|
|
|
|
1. Generate the RSA private key
|
|
|
|
`openssl genrsa -out ca.key 4096`
|
|
|
|
1. Create the CSR
|
|
|
|
`openssl req -new -nodes -key ca.key -config csrconfig_ca.txt -out ca.csr`
|
|
|
|
1. Self-sign your CSR
|
|
|
|
`openssl req -x509 -nodes -in ca.csr -days 1095 -key ca.key -config certconfig_ca.txt -extensions req_ext -out ca.crt`
|
|
|
|
### Create the Server Certificate
|
|
|
|
1. Create csrconfig_bumper.txt for use in later commands
|
|
|
|
**_csrconfig_bumper.txt_**
|
|
|
|
```
|
|
[ req ]
|
|
default_md = sha256
|
|
prompt = no
|
|
req_extensions = req_ext
|
|
distinguished_name = req_distinguished_name
|
|
[ req_distinguished_name ]
|
|
commonName = Bumper Server
|
|
organizationName = Bumper
|
|
[ req_ext ]
|
|
keyUsage=critical,digitalSignature,keyEncipherment
|
|
extendedKeyUsage=serverAuth,clientAuth
|
|
basicConstraints=critical,CA:false
|
|
subjectAltName = @alt_names
|
|
[ alt_names ]
|
|
DNS.0 = ecovacs.com
|
|
DNS.1 = *.ecovacs.com
|
|
DNS.2 = ecouser.net
|
|
DNS.3 = *.ecouser.net
|
|
DNS.4 = ecovacs.net
|
|
DNS.5 = *.ecovacs.net
|
|
DNS.6 = *.ww.ecouser.net
|
|
DNS.7 = *.dc-eu.ww.ecouser.net
|
|
DNS.8 = *.dc.ww.ecouser.net
|
|
DNS.9 = *.area.ww.ecouser.net
|
|
```
|
|
|
|
1. Create certconfig_bumper.txt for use in later commands
|
|
|
|
**_certconfig_bumper.txt_**
|
|
|
|
```
|
|
[ req ]
|
|
default_md = sha256
|
|
prompt = no
|
|
req_extensions = req_ext
|
|
distinguished_name = req_distinguished_name
|
|
[ req_distinguished_name ]
|
|
commonName = Bumper Server
|
|
organizationName = Bumper
|
|
[ req_ext ]
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always,issuer
|
|
keyUsage=critical,digitalSignature,keyEncipherment
|
|
extendedKeyUsage=serverAuth,clientAuth
|
|
basicConstraints=critical,CA:false
|
|
subjectAltName = @alt_names
|
|
[ alt_names ]
|
|
DNS.0 = ecovacs.com
|
|
DNS.1 = *.ecovacs.com
|
|
DNS.2 = ecouser.net
|
|
DNS.3 = *.ecouser.net
|
|
DNS.4 = ecovacs.net
|
|
DNS.5 = *.ecovacs.net
|
|
DNS.6 = *.ww.ecouser.net
|
|
DNS.7 = *.dc-eu.ww.ecouser.net
|
|
DNS.8 = *.dc.ww.ecouser.net
|
|
DNS.9 = *.area.ww.ecouser.net
|
|
```
|
|
|
|
1. Generate the RSA private key
|
|
|
|
`openssl genrsa -out bumper.key 4096`
|
|
|
|
1. Create the CSR
|
|
|
|
`openssl req -new -nodes -key bumper.key -config csrconfig_bumper.txt -out bumper.csr`
|
|
|
|
1. Sign your CSR with a root CA cert
|
|
|
|
`openssl x509 -req -in bumper.csr -days 365 -CA ca.crt -CAkey ca.key -extfile certconfig_bumper.txt -extensions req_ext -CAcreateserial -out bumper.crt`
|
|
|
|
## Using a Custom CA/Self
|
|
|
|
This should work siimilar to the OpenSSL method. Ensure the server certificate has the proper SANs (see above) in place.
|