ASIR2 DOC 2025/26

Assignmets docs for asir2

View on GitHub

Simple PKI(Public Key Infraestrucutra) with OpenSSL

PKI Process

  1. A requestor generates a CSR and submits it to the CA.
  2. The CA issues a certificate based on the CSR and returns it to the requestor.
  3. Should the certificate at some point be revoked, the CA adds it to its CRL.

Simple PKI

Tutorial

Simple PKI

pki
├── ca
│	 ├── root-ca
│	 │     └── root-ca.key
│	 ├── root-ca.crt
│	 ├── signing-ca
│	 │		 └── private
│	 │				├── signing-ca.key
│	 │				└── signing-ca-password.txt
│	 ├── signing-ca.crt
│	 └── signing-ca.csr
├── certs
│	 ├── issued
│	 │	 ├── lucas.crt
│	 │	 ├── david.crt
│	 │	 └── david.pem
│	 ├── requests
│	 │	 ├── lucas.csr
│	 │	 └── david.csr
├── crl
├── etc
└── sign_req.sh

Comandos openssl

Crear par de claves privada/pública

openssl genrsa -des3 -out private_key.key 2048
openssl genrsa -out private_key.key 2048
openssl genrsa -out $(whoami)_key.key 2048

Obtener clave pública a partir de par de claves.

openssl pkey -pubout -in private.key -out pub_key.pub

Crear CSR

openssl req -new -key $(whoami)_key.key -out pki/requests/$(whoami)_request.csr
openssl req -new -key $CERTS_DIR/private/$(whoami)_key.key -config $CERTS_DIR/etc/my_config.conf -out $CERTS_DIR/csr/$(whoami)_request.csr

Ver CSR

openssl req -in shared/requests/$(whoami)_request.csr -noout -text

Firmar CSR

openssl ca -config etc/signing-ca.conf -in certs/requests/fred.csr -out certs/issued/fred.crt -extensions email_ext

Ver certificado firmado

openssl x509 -text -in yourdomain.crt -noout

Verificar certificado en la cadena de confianza (Thrusted Chain)

openssl verify -CApath /etc/ssl/certs cert_to_be_verified.pem

Obtener clave pública del par de claves, certificado y CSR

openssl pkey -pubout -in private.key -out pub_key.pub
openssl req  -pubout -in request.csr -out pub_key.pub
openssl x509 -pubout -in certificate.crt -out pub_key.pub

Comprobar inconsistencias entre claves y certificados

openssl pkey -pubout -in private.key | openssl sha256
openssl req -pubkey -in request.csr -noout | openssl sha256
openssl x509 -pubkey -in certificate.crt -noout | openssl sha256

Convertir entre CRT y PEM

openssl x509 -in mycert.crt -out mycert.pem -outform PEM

Convertir a PKCS#12 By default, OpenSSL generates keys and CSRs using the PEM format. However, there might be occasions when you need to convert your key or certificate into a different format to export it to another system.

openssl pkcs12 -export -name "yourdomain-digicert-(expiration date)" \
-out yourdomain.pfx -inkey yourdomain.key -in yourdomain.crt

Firmar documentos

openssl dgst -sha256 -sign private.key" -out sign.txt.sha256 sign.txt
openssl dgst -sha256 -verify  <(openssl x509 -in "$(whoami)s Sign Key.crt"  -pubkey -noout) -signature sign.txt.sha256 sign.txt

El comando anterior se utiliza para firmar documentos, este genera un hash del documento que es encriptado con la clave privada, creando de esta forma una firma digital. El inconveniente es que la firma y el documento están en ficheros separados.

Firmar documentos PDF Utilizaremos la utilidad open-pdf-sign para firmar documentos pdf

$ mkdir -p ~/bin && cd ~/bin
$ wget https://github.com/open-pdf-sign/open-pdf-sign/releases/download/v0.3.0/open-pdf-sign.jar
$ echo 'PATH=$PATH:~/bin' >> ~/.bashrc
$java -jar open-pdf-sign.jar --add-page --page -1 --timestamp --input document.pdf --output document_signed.pdf --certificate certificate.crt --key private.key

Actividad

Crea un breve documento en formato Markdown indicando brevemente los pasos y los comandos llevados a cabo. El documento debe ser coherente y con sentido. Genera y firma el documento

Documentos/SAD/certs <-certificados firmados por CA de clase
├── csr  			<- enlace via ssshfs a la carpeta pki/certs/requests de sshfs  
├── signed      	<- enlace via ssshfs a la carpeta pki/certs/issued de sshfs 
├── etc				<- configuración
└── private			<- clave privada

Tip

Utiliza el comando sshfs para montar una carpeta compartida con el servidor via ssh

sshfs -o allow_other,default_permissions ubuntu@ip:/home/ubuntu/pki/certs/requests ~/Documentos/SAD/certs/csr
sshfs -o allow_other,default_permissions ubuntu@ip:/home/ubuntu/pki/certs/issued ~/Documentos/SAD/certs/signed

wget https://raw.githubusercontent.com/ASIR2-SGD/asir2-sgd.github.io/refs/heads/main/resources/files/openssl-server.conf

Glosario de términos

Componentes

Jerarquia PKI

CA Hierarchy

Formato de ficheros

Links

Tutorial