Simple script to generate certificate for stunnel
version 3.4.0.0
cipux_mkcertkey
None.
In order to add security to your XML-RPC server you should generate a certificate. This script shows a simple method to do that. You have to take the responsibility by yourself to make sure you understand what you do.
Generates a certificate and a key in /etc/cipux/stunnel.
cipux_mkcertkey
None.
Each \s-1SSL\s0 enabled XML-RPC server needs to present a valid X.509 certificate to the peer and it also needs a private key to decrypt the incoming data. The easiest way to obtain a certificate and a key is to generate them with the free openssl package. You can find more information on certificates generation below. The certificates must be in \s-1PEM\s0 format and must be sorted starting with the certificate to the highest level (root \s-1CA\s0)
Two things are important when generating the certificate-key pairs.
(1) Because the server has no way to obtain the password from the user, the private key cannot be encrypted. To create an unencrypted key add the \*(L"-nodes\*(R" option when running the req command from the openssl kit.
(2) The order of contents of the .pem file is also important. It should contain the unencrypted private key first, then a signed certificate (not certificate request). There should be also empty lines after certificate and private key. Plaintext certificate information appended on the top of generated certificate should be discarded. So the file should look like this:
-----BEGIN RSA PRIVATE KEY----- [encoded key] -----END RSA PRIVATE KEY----- [empty line] -----BEGIN CERTIFICATE----- [encoded certificate] -----END CERTIFICATE----- [empty line]
This can be stored in one file or in two files. This script stores the in to files to have the flexibility to use the certificate in other location. This to files will be created:
stunnel-cert.pem stunnel-key.pem
\s-1TODO:\s0 write explanations to the messages. Directory to store certs is not save! Should be for example: drwx------ 2 root root 4096 2008-04-17 21:15 /etc/cipux/stunnel
\s-1TODO\s0.
Carp CipUX File::stat Cwd \s-1POSIX\s0 Readonly Fatal English version
Not known.
Not known.
See the CipUX webpage and the manual at <http://www.cipux.org> See the mailing list http://sympa.cipworx.org/wws/info/cipux-devel <http://sympa.cipworx.org/wws/info/cipux-devel>
Christian Kuelker <[email protected]>
Copyright (C) 2008 by Christian Kuelker
This program is free software; you can redistribute it and/or modify it under the terms of the \s-1GNU\s0 General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but \s-1WITHOUT\s0 \s-1ANY\s0 \s-1WARRANTY\s0; without even the implied warranty of \s-1MERCHANTABILITY\s0 or \s-1FITNESS\s0 \s-1FOR\s0 A \s-1PARTICULAR\s0 \s-1PURPOSE\s0. See the \s-1GNU\s0 General Public License for more details.
You should have received a copy of the \s-1GNU\s0 General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, \s-1MA\s0 02111-1307 \s-1USA\s0