Editing Meeting-20130209

Jump to: navigation, search

Warning: You are not logged in.

Your IP address will be recorded in this page's edit history.
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision Your text
Line 26: Line 26:
 
*Presenter:  [[User:Patbarron|Pat Barron]]
 
*Presenter:  [[User:Patbarron|Pat Barron]]
  
There are a number of instances where a system administrator may wish to use certificate-based encryption to for security, to prevent spying on network traffic (for instance, running your own web server that is secured using HTTPS, so that web traffic is encrypted before being sent over the network), or to implement client authentication for something like a VPN.  This generally requires that a Certificate Authority (CA) issue certificates for your use - you might choose to use self-signed certificates instead, but this will result in dire security warnings from web browsers about certificates issued by an "untrusted issuer", and some things won't allow you to use self-signed certificates at all.  But why pay a recognized CA to issue certificates for you, that are probably going to be used by no one other than yourself and possibly your friends, and which don't need to be trusted by the general public?
+
''(Abstract to follow)''
 
+
The no-cost alternative is to create your own private CA, and register it as a trusted certificate issuer on your systems.  Linux distributions already include all the tools you need to do this, in the OpenSSL package - but the procedures for creating a CA and issuing certificates using the raw OpenSSL tools are obscure, complicated, and can only be done from the command line.
+
 
+
In this presentation, I will give a (very) brief overview of Public Key Infrastructure (a/k/a "PKI" - the general framework that supports certificate-based security), and talk just a little about how it works and what it's used for.  You will learn about "xca" (packaged for many mainstream Linux distros, and also available for Windows and Mac OS), an open source GUI interface to OpenSSL that makes managing a private CA quick and simple.  You will learn how to use "xca" to create a private root CA and generate your first server certificate - a process that, using the "xca" GUI, can be completed in two minutes or less.  You will learn how to register your private root CA as a trusted certificate issuer in Firefox and Internet Explorer (yeah, I know ... but people do use it...).  Finally, I will briefly describe how to use the server certificate you generated from your private root CA to secure your Apache-based web server.
+
 
+
If there is interest, possible future presentations may cover topics such as how to use your private CA to issue client certificates that can be used for client-based web authentication, and to secure private VPNs (such as you might build using OpenVPN, for remote connectivity into your home network, etc.).
+
  
  

Please note that all contributions to WPLUG may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see WPLUG:Copyrights for details). Do not submit copyrighted work without permission!

Cancel | Editing help (opens in new window)