Main

h1. CA Setup

* TODO: copy these instructions inline

** https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-a-certificate-authority-on-ubuntu-22-04

h2. Signing Instructions

h3. On the host machine or desktop

# Create directory

<pre>

$ mkdir csr && cd csr

</pre>

# Create key:

<pre>

$ openssl genrsa -out opnsense.key 8192

</pre>

# Create CSR:

<pre>

$ openssl req -new -key opnsense.key -out opnsense.req

</pre>

# Copy CSR to CA VM:

<pre>

$ scp opnsense.req dsorber@cauth:/tmp/

</pre>

h3. On CA.

# Start VM (should have been on already).

# Enter easy-rsa directory:

<pre>

cd ~/easy-rsa

</pre>

# Import CSR

<pre>

dsorber@cauth:~/easy-rsa$ ./easyrsa import-req /tmp/opnsense.req opnsense

Using SSL: openssl OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

The request has been successfully imported with a short name of: opnsense

You may now use this name to perform signing operations on this request.

</pre>

# Sign the request:

<pre>

dsorber@cauth:~/easy-rsa$ ./easyrsa sign-req server opnsense

Using SSL: openssl OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

You are about to sign the following certificate.

Please check over the details shown below for accuracy. Note that this request

has not been cryptographically verified. Please be sure it came from a trusted

source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 825 days:

subject=

    countryName               = US

    stateOrProvinceName       = Maryland

    localityName              = Derwood

    organizationName          = SorberHome

    organizationalUnitName    = EngineeringDepartment

    commonName                = opnsense.sorber.home

Type the word 'yes' to continue, or any other input to abort.

  Confirm request details: yes

Using configuration from /home/dsorber/easy-rsa/pki/easy-rsa-1713.Noeorx/tmp.1I1wpB

Enter pass phrase for /home/dsorber/easy-rsa/pki/private/ca.key:

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

countryName           :PRINTABLE:'US'

stateOrProvinceName   :ASN.1 12:'Maryland'

localityName          :ASN.1 12:'Derwood'

organizationName      :ASN.1 12:'SorberHome'

organizationalUnitName:ASN.1 12:'EngineeringDepartment'

commonName            :ASN.1 12:'opnsense.sorber.home'

Certificate is to be certified until Nov  1 20:07:12 2025 GMT (825 days)

Write out database with 1 new entries

Data Base Updated

</pre>

# Copy certificate request back to host machine:

<pre>

$ scp /home/dsorber/easy-rsa/pki/issued/opnsense.crt dsorber@enthoo:~/Desktop/csr/

</pre>