CA Setup¶

• TODO: copy these instructions inline
  • https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-a-certificate-authority-on-ubuntu-22-04

Signing Instructions¶

On the host machine or desktop¶

1. Create directory
   

   $ mkdir csr && cd csr
   

2. Create key:
   

   $ openssl genrsa -out opnsense.key 8192
   

3. Create CSR:
   

   $ openssl req -new -key opnsense.key -out opnsense.req
   

4. Copy CSR to CA VM:
   

   $ scp opnsense.req dsorber@cauth:/tmp/
   

On CA.¶

1. Start VM (should have been on already).
2. Enter easy-rsa directory:
   

   cd ~/easy-rsa
   

3. Import CSR
   

   dsorber@cauth:~/easy-rsa$ ./easyrsa import-req /tmp/opnsense.req opnsense
   Using SSL: openssl OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
   
   The request has been successfully imported with a short name of: opnsense
   You may now use this name to perform signing operations on this request.
   
   

4. Sign the request:
   

   dsorber@cauth:~/easy-rsa$ ./easyrsa sign-req server opnsense
   Using SSL: openssl OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
   
   You are about to sign the following certificate.
   Please check over the details shown below for accuracy. Note that this request
   has not been cryptographically verified. Please be sure it came from a trusted
   source or that you have verified the request checksum with the sender.
   
   Request subject, to be signed as a server certificate for 825 days:
   
   subject=
       countryName               = US
       stateOrProvinceName       = Maryland
       localityName              = Derwood
       organizationName          = SorberHome
       organizationalUnitName    = EngineeringDepartment
       commonName                = opnsense.sorber.home
   
   Type the word 'yes' to continue, or any other input to abort.
     Confirm request details: yes
   Using configuration from /home/dsorber/easy-rsa/pki/easy-rsa-1713.Noeorx/tmp.1I1wpB
   Enter pass phrase for /home/dsorber/easy-rsa/pki/private/ca.key:
   Check that the request matches the signature
   Signature ok
   The Subject's Distinguished Name is as follows
   countryName           :PRINTABLE:'US'
   stateOrProvinceName   :ASN.1 12:'Maryland'
   localityName          :ASN.1 12:'Derwood'
   organizationName      :ASN.1 12:'SorberHome'
   organizationalUnitName:ASN.1 12:'EngineeringDepartment'
   commonName            :ASN.1 12:'opnsense.sorber.home'
   Certificate is to be certified until Nov  1 20:07:12 2025 GMT (825 days)
   
   Write out database with 1 new entries
   Data Base Updated
   

5. Copy certificate request back to host machine:
   

   $ scp /home/dsorber/easy-rsa/pki/issued/opnsense.crt dsorber@enthoo:~/Desktop/csr/