TweetFollow Us on Twitter

Demystifying PKI-Part 2

Volume Number: 25
Issue Number: 07
Column Tag: Security

Demystifying PKI-Part 2

A Series of Articles and How-Tos about PKI technology in the OS X environment

By Michele (Mike) Hjörleifsson

Part Two: Establishing your own Standalone CA


Last month we traveled the road of history reviewing where PKI came from, what it is and how it is used. This month, let's dive into what we can use PKI for on a daily basis and then we'll set up our own standalone Certificate Authority (CA) and start cranking out some certificates of our own.

Issuing SSL certificates to protect websites, e-mail, iChat, iCal and other OS X services is probably the most popular use for PKI on the OS X platform. Yet, there are some other interesting uses you'll want to know about. Digital signing has become a more popular use of PKI so it's worth mentioning in this context. If you have ever downloaded an ISO file or manually downloaded an update from Apple, you have probably seen either an MD-5 or SHA-1 hash that is associated with the download. The hash provides a sanity check to ensure you downloaded the entire file properly and in tact. The concept behind digital signing is similar to providing this hash with one caveat; it uses your personal certificate as part of the generation process so that the signature is specific to you. This is the smoke behind the mirrors on digital signing.

Mac OS X Leopard provides an application for administrators to create a CA and provide some basic functionality utilizing OpenSSL via a little known and somewhat hidden GUI application called Certificate Assistant. In the following section, we will create a CA and then generate a self-signed certificate that can be used for several of the Mac OS X server-provided services.

From Finder, press Command+Shift+U to open the Utilities folder (a sub-folder of your Applications folder). Select and then open the Keychain Access application. From the Keychain Access menu, select Certificate Assistant and then choose Create a Certificate Authority.

The Certificate Assistant Application launches and then prompts you to enter some basic information about the CA you want to create. Enter the name of the CA. For 'Type,' select Self Signed Root CA. Make sure the Let me override defaults box is checked.

Click Continue to proceed to the next dialog box.


Enter an arbitrary, unique serial number and a validity period. Mac OS X remembers certificate serial numbers and rejects a new certificate with the same serial number as a previous certificate (coming from the same authority, that is). Make sure you keep track of serial numbers. The User Certificate Type must be set to SSL Server. The other settings are for generating a pretty CA web page to let people make certificate requests for your new authority (you may want to use that), and to sign your certificate invitation.


Enter the basic contact information for the CA certificate. The Name (Common Name) field doesn't have to be a valid domain name, since the CA certificate won't be used by any server, but it is good practice to provide accurate information especially if you will be providing services to individuals outside of your internal organization. The email address entered is presented when someone looks at the details of the certificate and wants to pose a question to the owner of the certificate or certificate authority.


The next screen presents options for the key pair cryptography elements such as the size of the key and the algorithm used to create the key. The defaults are acceptable since 2048 bit keys are considered un-hackable and RSA is the most common algorithm in use today.


The CA certificate must have a Key Usage Extension with at least the Signature and Certificate Signing capability boxes checked. If either one of those capabilities are not specified, browsers and client applications will reject any child certificate (the certificates you create for your specific servers or services) of the CA certificate.


Next, specify the default key usage extension settings for any leaf certificate (also called a sub-certificate) created with the CA certificate as the root. SSL server certificates must have at least the Key Encipherment and Key Agreement capability boxes checked. If either one of those capabilities is not checked, services and browsers will reject the certificate.


Although documentation suggests this may not be necessary, giving the CA certificate an extended key usage extension with at least the SSL Server Authentication capability bit set has no serious consequences and provides additional insurance that browsers will be happy. Note that the default value is All, which provides more flexibility for you to issue certificates specifically for services assigned to dedicated servers (such as Mail).


Though the following screen may look the same as its predecessor, there is a purpose for the seeming redundancy. These options apply to the leaf or sub-certificates issued by the CA and what they should be allowed to do. You are setting permissions for the issued certificates coming from your certificate authority. Using Any is fine, but at a minimum you will want to employ SSL Server Authentication, the most common use for the certificates you issue.


The CA certificate must have a basic constraints extension with at least the Use this certificate as a certificate authority option specified. If it does not, client browsers and client side applications will reject any child certificate of the CA certificate and our entire exercise was for naught.


This step, though it seems redundant, specifies default basic constraints extension settings for any leaf or sub-certificate created with the CA certificate as the root. SSL server certificates must not have the Use this certificate as a certificate authority option specified (while having a basic constraints extension). If the extension is missing or that option is specified, services and client applications will reject the certificate.


Any certificate with the SSL Server type must have a subject alternate name extension specifying either the dNSName field or the iPAddress field. Obviously, there are no special constraints on the value of either of those fields for the CA certificate.


Again, any certificate with the SSL Server type must have a subject alternate name extension specifying either the dNSName field or the iPAddress field. The value of those fields must match the domain name or IP address which clients will use to contact SSL servers using any child certificate of the CA certificate. Obviously, we will have to override this value when creating each such child certificate unless we're creating them for the same server all the time. Nevertheless, Certificate Assistant requires a value to be specified to continue, so provide a reasonable default.


Select the keychain in which the CA certificate will be stored. If you want browsers using Keychain Services to accept child certificates of the CA certificate, check the On this machine, trust certificates signed by this CA box. Note that, as the label implies, this affects the trust setting for the CA certificate for the entire machine, not just your specific system user. Consider the consequences of that choice carefully. It is possible to change trust settings on a per user basis.


We can finally appreciate the fruit of our labor. Double-clicking the CA certificate in Keychain Access will allow you to confirm that all the required settings, options and capabilities are properly configured.


Now that we have a valid CA creating certificates for our web and other services, we see that utilizing the CA is pretty easy. I will not repeat the entire sequence of operations presented for the CA certificate, but rather focus on the steps that are specific to the creation of an SSL server leaf certificate. Keep in mind that the various restrictions mentioned above concerned leaf certificates since we have to override the default values we specified during the creation of the CA certificate. Certificate Assistant does not fill in those defaults.

From the Keychain Access application, choose the Create a Certificate command from the Certificate Assistant menu.


Enter the domain name that clients will use to access the SSL server as the certificate's name. For Type, choose Leaf. Check the Let me override defaults box to edit some of the certificate's settings we specified earlier.


Enter a serial number different from the CA certificate and different from any other leaf certificate you have already created, even if they were for the same domain. Applications check and keep track of certificate serial numbers. Certificates with identical serial numbers are rejected. Also make sure that the Certificate Type is set to SSL Server, otherwise applications may reject the certificate.


The Name (Common Name) field must match the domain that clients will use to connect to the SSL server; otherwise, applications will either reject the certificate out of hand or prompt you with an ominous warning message about the certificate mismatch.


Select the CA certificate created earlier.


SSL server certificates must have a key usage extension with the Key Encipherment and Key Agreement boxes checked. If they are not enabled, applications may reject the certificate.


SSL server certificates must have an extended key usage extension with, minimally, the SSL Server Authentication check box set. If it is not, browsers and other applications may reject the certificate.


SSL server certificates must have a basic constraints extension with the Use this certificate as a certificate authority option disabled.


SSL server certificates must have a subject alternate name extension with either the dNSName field or the iPAddress field specified. The values for those fields should match what clients will use to connect to the SSL server. In order words, the value for the dNSName field should match the value of the Name (Common Name) field of the certificate (specified the Certificate Information dialog box) and the value iPAddress field should match the IP address to which the dNSName domain resolves.


We can once more appreciate the fruit of our labor. Double-clicking the certificate in Keychain Access will allow you to confirm that all the required settings, options and capabilities are properly configured.

We can now install this certificate onto our Mac OS X Server and use it for Web, iChat, iCal, Open Directory or any number of services.


Now, while this may seem like a ton of work to get an SSL certificate, keep in mind that you will typically create the CA once on a standalone, preferably non-network connected machine and then issue and copy the SSL certificates as you need them when deploying servers or additional services. Why would you want this machine off the network you ask? Well, simple my dear Watson. If someone gets hold of your root keys or can get onto the CA machine they can issue certificates all day long and create bogus websites with security certificates in your organization's namenot a good thing. We will dive a little deeper into this concept in later articles when we discuss additional methods of protecting root keys and offloading cryptographic processing to a hardware security module (HSM).

Digital Signing

Digital signing has become a hot topic in today's information technology circles. So what does digital signing mean exactly? There are three main types of digital signatures: one that is inclusive of the content; one that is separated from the content; and the third which is a digest or "hash" of the content.

For instance, when you manually download an Apple Update from the Apple website you will notice a line with SHA1 = xxxxx. This represents a digital "hash" for the download that is used to check the integrity of the downloaded file ensuring no one has tampered with a single bit of it. Here's a real life example.

Go to http://support.apple.com/downloads/iTunes_8_1_1_for_Windows and download the file.

Take note of the SHA=cad92e6882b5fb49d710d342f315d7d6293e2b0a at the bottom of the description. Once you have downloaded the file you can open a terminal and type:

   openssl sha1 iTunes811.dmg

The following is returned if the file has been downloaded intact and matches the file created by the signer. This is an example of a separate signature, signing:

   SHA1(iTunes811.dmg)= cad92e6882b5fb49d710d342f315d7d6293e2b0a

Another example of a digital signature is digitally signing email. Most users are unaware that it is extremely simple to forge an email from one party to another without the receiving party being aware of the forgery. Detecting the forgery would require the help of a forensic administrator or a savvy IT administrator. Digitally signing an email ensures that the message originated from the person in the from field by using something called S/MIME or, secure mime (Multipurpose Internet Mail Extensions), which puts a signature derived from your personal certificate into the headers of the email. If the email is tampered with in any fashion the signature is invalidated and most email programs will display an X or some other visual indicator to show the mail has been tampered with. This is a common example of an inclusive signature.

Installing this type of signature is pretty simple. You can issue a personal certificate from the CA you created above and double click it to put the certificate into your login keychain. Double click on it and "Always-Trust" the certificate for email. Be sure that the certificate's email contact matches your "from" address. Apple Mail will auto-magically change its compose pane to give you a check mark and lock icon below the subject on the right allowing you to sign and encrypt an email. That's all there is to it for signing. For encryption, since that is a little more involved, you need to send a signed email to your desired recipient and they need to send you one. Once the both of you double click and accept the other one's certificates, you can send each other encrypted emails that only the two of you and the root CA can open (because they can store your private certificate).

Digitally signing documents is gaining in popularity. The most popular applications that provide this capability are Adobe Acrobat for creating PDFs, and OpenOffice. Unfortunately Microsoft Office 2008 does not provide this functionality, while its Windows counterpart does, we can only hope the next revision will or someone will write a utility for injecting a certificate into Office 2008 documents. And sadly Apple's Preview is not currently signature aware either at the time I wrote this article.

Why sign a PDF or other document? Glad you asked. In 48 states, digital signatures of varying types are actually considered legal signatures. That's right, you can even sign your tax returns with a digital signature and put that pen away. The IRS has to accept it (if it meets some basic criteria). An even more obvious use of digital signatures in these types of documents is to make them tamper evident. Once you sign a document if anyone tampers with its contents at all it will "break" the signature. Why "break" vs. break? Well, it doesn't actually ruin anything. It just becomes quite evident via one or more visual indicators that the document was tampered with. Again we come back around to the question of why digitally sign a document? A couple of examples of documents you may want to digitally sign are legal contracts, financial documents, documents containing personal identification (more on this later), basically any document you want to ensure no one touches before it reaches the desired recipient.

Going Forward

While the simple CA installation routine above works well for smaller environments, it does not scale well. And, more importantly, it does not provide some key features an administrator would want to implement in a larger environment.

For instance, say you issued a certificate for a user to sign and encrypt their email. Later, that user has moved on to another company. How do you ensure the user isn't still using that certificate to sign emails as authentic your company emails? This is a key component in a certificate system and it is called revocation.

Certificate revocation is typically performed in one of two ways. Certificate revocation lists (CRLs) are the traditional way of maintaining a list of which certificates are no longer valid. CRLs were provided or distributed to resources that validated the certificates. This method proved a bit inefficient and validation occurred "offline" so a newer technology called Online Certificate Status Protocol (OCSP) was developed to allow for online validation and revocation of certificates in a more dynamic environment.

Additionally, in larger environments, you may be issuing various types of certificates, and may want to allow other administrators to create SSL certificates for their own internal servers, let users register and create their own email certificates and so on. Offloading some of the administrative burden makes the system more efficient. In next month's installment, we explore enterprise grade CA choices and a great choice for deploying enterprise certificate authority services in an Apple Mac OS X environment.


Michele (Mike) Hjörleifsson has been programming Apple computers since the Apple II+, and implementing network and remote access security technologies since the early '90s. He has worked with the nation's largest corporations and government institutions. Mike is currently a certified Apple trainer and independent consultant. Feel free to contact him at mhjorleifsson@me.com

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Postbox 5.0.9 - Powerful and flexible em...
Postbox is a new email application that helps you organize your work life and get stuff done. It has all the elegance and simplicity of Apple Mail, but with more power and flexibility to manage even... Read more
VueScan 9.5.61 - Scanner software with a...
VueScan is a scanning program that works with most high-quality flatbed and film scanners to produce scans that have excellent color fidelity and color balance. VueScan is easy to use, and has... Read more
DiskCatalogMaker 6.5.16 - Catalog your d...
DiskCatalogMaker is a simple disk management tool which catalogs disks. Simple, light-weight, and fast. Finder-like intuitive look and feel. Super-fast search algorithm. Can compress catalog data... Read more
TrailRunner 3.8.827 - Route planning for...
TrailRunner is the perfect companion for runners, bikers, hikers, and all people wandering under the sky. Plan routes on a geographical map. Import GPS or workout recordings and journalize your... Read more
Civilization VI 1.0.1 - Next iteration o...
Sid Meier’s Civilization VI is the next entry in the popular Civilization franchise. Originally created by legendary game designer Sid Meier, Civilization is a strategy game in which you attempt to... Read more
Chromium 55.0.2883.75 - Fast and stable...
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. Version 55.0.2883.75: Security fixes: High CVE-2016... Read more
Google Chrome 55.0.2883.75 - Modern and...
Google Chrome is a Web browser by Google, created to be a modern platform for Web pages and applications. It utilizes very fast loading of Web pages and has a V8 engine, which is a custom built... Read more
VirtualBox 5.1.10 - x86 virtualization s...
VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. Not only is VirtualBox an extremely feature rich, high performance product for enterprise customers... Read more
Pixa 1.1.9 - Quickly and easily organize...
Pixa is an image-organizing application. The new app functions well, is easy to use, and helps people organize their images quickly and easily on their computers. For those who prefer not to use the... Read more
VirtualBox 5.1.10 - x86 virtualization s...
VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. Not only is VirtualBox an extremely feature rich, high performance product for enterprise customers... Read more

Latest Forum Discussions

See All

Amateur Surgeon 4 Guide: Become the worl...
It's time to wield your trusty pizza cutter again, as Amateur Surgeon has returned with a whole fresh set of challenges (and some old, familiar ones, too). Starting anew isn't easy, especially when all you have at your disposal is a lighter, the... | Read more »
Le Parker: Sous Chef Extraordinaire (Ga...
Le Parker: Sous Chef Extraordinaire 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: | Read more »
Telltale Games really is working on a Gu...
Telltale Games' next episodic adventure is indeed Guardians of the Galaxy. A document tied to the voice actors strike suggested that the project was in the work, but now we have direct confirmation following an announcement at the Game Awards that... | Read more »
Amateur Surgeon returns to iOS and Andro...
Amateur Surgeon and its two sequels disappeared from the App Store some time and it was sad days for all. But now, just in time for the holidays, the Adult Swim favorite makes its joyous return in the shape of Amateur Surgeon 4, a remake with... | Read more »
The best board games on mobile
Sometimes you need to ditch all of the high speed, high action games in favor of something a little more traditional. If you don't feel like parting ways from your mobile device, though, there are still plenty of ways to get that old-school fix.... | Read more »
The best Facebook Messenger Instant Game...
Facebook's new Instant Games is now here, meaning you can play games with your friends directly via Facebook. It's a fun new way to connect with friends, of course, but it's also proving to be a solid gaming experience in its own right, with a... | Read more »
You can now play game's on Facebook...
Facebook launched its new Instant Games platform in an exciting new attempt to engage its user base. As a result, you can now play a number of different games directly through Facebook Messenger. All of these games run with HTML5, meaning you play... | Read more »
Apollo Justice Ace Attorney (Games)
Apollo Justice Ace Attorney 1.00.00 Device: iOS Universal Category: Games Price: $.99, Version: 1.00.00 (iTunes) Description: Court Is Back In Session Star as rookie defense attorney, Apollo Justice, as he visits crime scenes,... | Read more »
KORG iWAVESTATION (Music)
KORG iWAVESTATION 1.0 Device: iOS Universal Category: Music Price: $19.99, Version: 1.0 (iTunes) Description: A revolutionary new world of sound.The Wave Sequence Synthesizer for iPad - KORG iWAVESTATION | Read more »
Don't Grind Guide: Tips for becomin...
Don’t Grind is a surprising, derpy little one touch game with fun hand-drawn graphics. The goal is simple -- get the high score without being chopped to bits. That can be tough when you’re not used to the game, and that’s compounded by the fact... | Read more »

Price Scanner via MacPrices.net

Holiday sale: Apple MacBook Airs available fo...
B&H Photo has 13″ MacBook Airs on sale for $100 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 1.6GHz/128GB MacBook Air (MMGF2LL/A): $899 $100 off MSRP - 13″ 1.6GHz/... Read more
13-inch Silver Touch Bar MacBook Pro in stock...
Amazon has the new 2016 13″ 2.9GHz/256GB Silver Touch Bar MacBook Pro (MLVP2LL/A) in stock today and on sale for $1749 including free shipping. That’s $50 off MSRP, and it’s the lowest price... Read more
Parallels Toolbox 1.3 for Mac Offers 25 Singl...
Parallels has launched Parallels Toolbox 1.3 for Mac, an upgrade that adds five new utilities to the stand-alone application which was released in August and is available exclusively online at http... Read more
OWC Mercury Elite Pro Dual mini Ultra-Portabl...
OWC has introduced the new OWC Mercury Elite Pro Dual mini, a powerful yet ultra-portable dual-drive RAID solution. The new Mercury Elite Pro Dual mini packs phenomenal performance into a small... Read more
Clearance 13-inch Retina MacBook Pros availab...
B&H Photo has clearance 2015 13″ Retina Apple MacBook Pros available for up to $200 off original MSRP. Shipping is free, and B&H charges NY tax only: - 13″ 2.7GHz/128GB Retina MacBook Pro: $... Read more
Roundup of 2016 13-inch 2.0GHz MacBook Pro sa...
B&H has the non-Touch Bar 13″ MacBook Pros in stock today for $50-$100 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 2.0GHz MacBook Pro Space Gray (MLL42LL/A): $1449 $... Read more
New 13-inch 2.0GHz Space Gray MacBook Pro in...
Adorama has the new 13″ 2.0GHz Space Gray MacBook Pro (non-Touch Bar, MLL42LL/A) in stock for $1499 including a free 3-year AppleCare Protection Plan. Shipping is free, and Adorama charges sales tax... Read more
Finnair Adopts iOS Enterprise iPad Apps from...
Finnair and IBM have announced a first-of-its-kind agreement to utilize iOS enterprise apps from IBM to support the airline’s overall digital transformation. Finnair is focused on Asia-Europe traffic... Read more
Tech21 Launches Evo Go iPhone 7 Case Availabl...
Tech21 has announced the launch of the Evo Go case for Apple iPhone 7 and iPhone 7 Plus, exclusively at T-Mobile. Available online and at participating T-Mobile stores nationwide, Evo Go cases start... Read more
Apple Turns (RED) with More Ways to Join the...
In recognition of World AIDS Day, Apple is offering more ways than ever for customers to join (RED) in its mission to create an AIDS-free generation. Apple is the worlds largest corporate contributor... Read more

Jobs Board

*Apple* Retail - Multiple Positions- Kansas...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions- Chicago...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
Hardware Design Validation Engineer - *Apple...
The Apple Watch team is looking for a Hardware Design Validation Engineer. This person will be part of the Apple Watch hardware team with responsibilities for Read more
SW Engineer *Apple* TV Frameworks - Apple I...
The Apple TV team is looking for a software...create features that reflect the look and feel of Apple TV. Description: Were looking for someone who is Read more
*Apple* Retail - Multiple Positions- Greenwi...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.