Susan wrote:
Yes. You go to the RHCS web interface, click "Get CA Cert Chain", and you can download or copy/paste the CA cert for use with client apps (or importing into your web browser or email program or etc.). This assumes you are using RHCS as your CA.Hi, everyone. I think this subject has been briefly raised before but I've more questions. Can RHCS be used to hand out CA certs to Unix clients (linux/solaris)?
Has anybody done this?
We used this extensively at Netscape.
RHCS doesn't seem to be opensourced. Is there a reliable free alternative?
I don't know.
The only way to do this is to have a real FQDN as the cn of your server cert subject DN. When the server presents its cert during the SSL handshake, the client can verify that the CA (whose cert you have in the client cert db) signed the server's cert, and that the hostname in subject DN in the server cert corresponds to the hostname that the server is on (reverse DNS lookup of the IP address of the server).The problem I'm trying to solve is that my CA cert is self-signed. I guess even if it weren't, the management is a little concerned about MITM attacks against the FDS, so we need a way to verify that the server saying that it's our FDS really is the FDS.
Right now no certs aredeployed on the clients, we're using them only for SSL traffic encryption.
Do you mean client cert auth?
CA certs or client certs? For the CA cert problem, AFAIK, there is no way around it - you have to configure your clients to trust your CA one way or another. You can mitigate this somewhat by going through the process of getting a real CA cert from one of the trusted root CAs listed in your web browser or email client.What's the best way to go about doing this? I don't want to manually create/deploy dozens of certs for various clients.
RHCS also implements CRL generation and publishing, and also supports OCSP. One of our engineers is developing a mod_revocator Apache module which will automatically get CRLs for Apache certificate status checking (for servers and clients).I also need a way to implement CRL somehow, in case a box is comprosmised.
Thank you. __________________________________________________ Do You Yahoo!?Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
