12444735efb1b15309422c8434569806b357c627
S\303\251curit\303\251/Certificats/SSL.md
| ... | ... | @@ -0,0 +1,129 @@ |
| 1 | +Certificats SSL |
|
| 2 | +============== |
|
| 3 | + |
|
| 4 | +## Généralités |
|
| 5 | + |
|
| 6 | +Les certificats SSL au ResEl permettent de se connecter de façon sécurisé aux sites web du ResEl. |
|
| 7 | + |
|
| 8 | +## Liste des machines disposants du certificat |
|
| 9 | + |
|
| 10 | +* Cyric (*cacert.pem doit rester accessible pour ldap !*) |
|
| 11 | +* Golf |
|
| 12 | +* Tracteur |
|
| 13 | +* Barsac |
|
| 14 | +* Padova |
|
| 15 | +* W3 |
|
| 16 | +* Hera |
|
| 17 | + * `/etc/apache2/ssl` |
|
| 18 | +* Knuckles |
|
| 19 | + * `/etc/nginx/ssl` |
|
| 20 | +* Tails |
|
| 21 | + * `/etc/lighttpd/ssl` |
|
| 22 | +* Jarod |
|
| 23 | + * `/etc/ejabberd/ssl` |
|
| 24 | + |
|
| 25 | +## Fournisseurs |
|
| 26 | + |
|
| 27 | +### StartSSL, au 2015-10-09 |
|
| 28 | + |
|
| 29 | +* Lien vers le CA : https://www.startssl.com/certs/ca-sha2.pem |
|
| 30 | +* Lien vers le Sub : https://class2.test.itk98.net/class2.ca.pem ~~https://www.startssl.com/certs/class2/sha2/pem/sub.class2.server.sha2.ca.pem~~ |
|
| 31 | + |
|
| 32 | +Workaround pour le "bug" des subs SHA2 : |
|
| 33 | + |
|
| 34 | +* https://serverfault.com/questions/684736/why-does-chrome-on-1-computer-say-my-certificate-is-invalid-insecure |
|
| 35 | +* https://code.google.com/p/chromium/issues/detail?id=473105 |
|
| 36 | +* https://forum.startcom.org/viewtopic.php?p=21826#p21826 |
|
| 37 | +* https://forum.startcom.org/viewtopic.php?p=21832#p21832 |
|
| 38 | +* https://class2.test.itk98.net/ => Le sub à utiliser est le suivant : https://class2.test.itk98.net/class2.ca.pem |
|
| 39 | + |
|
| 40 | +## Structure du dossier de certificat |
|
| 41 | + |
|
| 42 | +``` |
|
| 43 | +20:07 root@host ~ # cd /etc/apache2/ssl |
|
| 44 | +20:08 root@host /etc/apache2/ssl # chmod o-rx -R . |
|
| 45 | +20:09 root@host /etc/apache2/ssl # ll |
|
| 46 | +total 2,0K |
|
| 47 | +drwxr-x--- 2 root root 1,0K oct. 9 14:34 2015/ |
|
| 48 | +drwxr-x--- 4 root root 1,0K oct. 9 14:21 bak_20151009/ |
|
| 49 | +lrwxrwxrwx 1 root root 20 oct. 9 14:21 ca.pem -> 2015/startssl-ca.pem |
|
| 50 | +lrwxrwxrwx 1 root root 28 oct. 9 14:28 ca.sub.pem -> 2015/startssl-sub.class2.pem |
|
| 51 | +lrwxrwxrwx 1 root root 31 oct. 9 14:32 resel.key -> 2015/fr.resel.wildcard.2015.priv.rsa |
|
| 52 | +lrwxrwxrwx 1 root root 26 oct. 9 14:31 resel.pem -> 2015/fr.resel.wildcard.2015.pem |
|
| 53 | +``` |
|
| 54 | + |
|
| 55 | +``` |
|
| 56 | +20:10 root@src-host /etc/apache2/ssl # scp -rp $(date +'%Y')/ user@dst-host.adm:/tmp/ |
|
| 57 | + |
|
| 58 | +rm -rf /tmp/ssl/old |
|
| 59 | +cd <dossier destination> |
|
| 60 | +mv /tmp/ssl/* . |
|
| 61 | +sudo rm *.cert |
|
| 62 | +sudo rm *.key |
|
| 63 | + |
|
| 64 | +chown root:root $(date +'%Y') |
|
| 65 | +ln -s $(date +'%Y')/startssl-ca.pem ca.pem |
|
| 66 | +ln -s $(date +'%Y')/startssl-sub.class2.pem ca.sub.pem |
|
| 67 | +ln -s $(date +'%Y')/fr.resel.wildcard.$(date +'%Y').rsa.priv resel.key |
|
| 68 | +ln -s $(date +'%Y')/fr.resel.wildcard.$(date +'%Y').pem resel.pem |
|
| 69 | +chmod o-rx -R . |
|
| 70 | + |
|
| 71 | +pour nginx : cat chain.cert >> resel.cert |
|
| 72 | +pour lighttpd : cat resel.key >> resel.cert |
|
| 73 | +``` |
|
| 74 | + |
|
| 75 | +## Configuration |
|
| 76 | + |
|
| 77 | +### Apache |
|
| 78 | +``` |
|
| 79 | +# La ligne suivante correspond au CA des certificats *client*, le concerne pas les certificats serveurs. |
|
| 80 | +# https://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcacertificatepath |
|
| 81 | +# SSLCACertificateFile /etc/apache2/ssl/ca.pem |
|
| 82 | +SSLCertificateChainFile /etc/apache2/ssl/ca.sub.pem |
|
| 83 | +SSLCertificateFile /etc/apache2/ssl/resel.pem |
|
| 84 | +SSLCertificateKeyFile /etc/apache2/ssl/resel.key |
|
| 85 | +``` |
|
| 86 | + |
|
| 87 | +### Nginx |
|
| 88 | +``` |
|
| 89 | +server { |
|
| 90 | + # Exemple : |
|
| 91 | + #listen 443 ssl; |
|
| 92 | + |
|
| 93 | + [..] |
|
| 94 | + |
|
| 95 | + ssl_certificate /etc/nginx/ssl/resel.pem; |
|
| 96 | + ssl_certificate_key /etc/nginx/ssl/resel.key; |
|
| 97 | +} |
|
| 98 | +``` |
|
| 99 | + |
|
| 100 | +### Lighttpd |
|
| 101 | +``` |
|
| 102 | +15:48 alevavas@tails /etc/lighttpd % cat conf-enabled/30-ssl-resel.conf |
|
| 103 | +# /usr/share/doc/lighttpd/ssl.txt |
|
| 104 | + |
|
| 105 | +$SERVER["socket"] == ":443" { |
|
| 106 | + server.use-ipv6 = "enable" |
|
| 107 | + ssl.engine = "enable" |
|
| 108 | + ssl.pemfile = "/etc/lighttpd/ssl/resel.pem" |
|
| 109 | + ssl.ca-file = "/etc/lighttpd/ssl/ca.sub.pem" |
|
| 110 | + |
|
| 111 | + [..] |
|
| 112 | +} |
|
| 113 | +``` |
|
| 114 | + |
|
| 115 | +## Notes |
|
| 116 | + |
|
| 117 | +### DHparam |
|
| 118 | +Pour plus de sécurité, il peut être intéressant de génerer une nouvelle suite de dhparam à l'installation afin de ne pas utiliser celle par défaut de la distribution. |
|
| 119 | + |
|
| 120 | +``` |
|
| 121 | +openssl dhparam -dsaparam -out dhparams-4096.pem 4096 |
|
| 122 | +``` |
|
| 123 | + |
|
| 124 | +## Ressources utiles |
|
| 125 | +(TODO) |
|
| 126 | + |
|
| 127 | +## TODO (rédacteur) |
|
| 128 | +* Peut être rédiger un peu plus et contextualiser |
|
| 129 | +* Ajouter des ressources |