Steven M. Jordan

Showing posts with label PKI. Show all posts

by Steven Jordan on 4/16/2014

Take Away: Use Microsoft Windows and its MakeCert tool to create free SSL certificates. These custom-made certificates can be added as trusted resources for individual users and computers. Their primary use is generally for testing purposes, code-signing, and other unique situations.

Create certificates in three easy steps:

Download MakeCert: Use the Microsoft tool called MakeCert to generate the certificate. Microsoft includes MakeCert with their Windows 8 Software and Development Toolkit.

*Hint, choose the Windows App Certificate Kit to avoid downloading the entire SDK.

MakeCert is also available for download on my OneDrive.
Create a Certificate and Private Key:

a.) Makecert.exe is located in the c:\Windows Kits\8.0\bin\x64 directory by default. Feel free to copy it to a different location.

b.) Run makecert.exe with the following extended options:

C:\scripts>makecert -n "CN=Self Sign Cert" -a sha256 -eku "1.3.6.1.5.5.7.3.3" -r -sv root.pvk root.cer -ss root -sr localmachine

N.B., -n=Subject Name; -a=digest algorithm; -eku=Enhanced Key Usage, OID; -r=self signed; -sv= Subject PVK file; -ss=Certificate Store Name; -sr=Certificate store location.

d.) The above command requests a new private key password.

e.) The new private key and certificate file are located in the same directory as the Makecert application.
Pair the Certificate and Private Key:

a.) Run the following command:

C:\scripts>makecert -pe -n "CN=PowerShell local certificate root" -ss MY -a sha1 -eku "1.3.6.1.5.5.7.3.3" -iv root.pvk - ic root.cer

b.) The above command requests the private key password.

c.) The certificate pair automatically imports into the Windows Certificate Store. This is confirmed using the MMC Certificate Snap-In.

Start → MMC → Add/Remove Snap-In → Certificates → Personal

That's It!

References:

http://blogs.msdn.com/b/kaushal/archive/2013/06/13/working-with-wild-card-certificates.aspx
http://kreelbits.blogspot.com/2013/09/deploying-signed-powershell-scripts-in.html
http://technet.microsoft.com/en-us/magazine/2008.04.powershell.aspx

Walk-through guide for StartSSL Certificates, Part 1 of 4.

Last updated March 1st, 2014 by Steven Jordan

Takeaway: StartSSL provides a phenomenal public service; free SSL certificates! This article provides detailed instructions for working with StartSSL certificates. This is the first part in a four-part series on how to use StartSSL certificates.

Additional StartSSL articles:
1. Sign-up: Resister with StartSSL.
2. Personal Certificates: Back-up and authenticate to StartSSL with personal certificates.
3. New Cert: Generate the StartSSL certificate.
4. Windows Certificate Management: Import the StartSSL certificate into Windows.

StartSSL Introduction:

StartSSL is a public certificate authority (CA) who offers free SSL certificates. StartSSL certificates are every bit as secure as those provided by VeriSign, GoDaddy, or Thawte. In addition, StartSSL integrates with nearly every browser and operating system as a trusted root certificate; end-users do not receive identity warnings!

StartSSL certificates work great and they are free -so what's the catch?

StartSSL class 1 certificates are free, but they are only valid for one year. The certificates must be renewed (for free) each year.
StartSSL offers limited support. The StartSSL website is not intuitive and is outright complicated compared to other public CAs (e.g., GoDaddy).
Certificate revocation (i.e., mistakes) cost $25. Don't lose your private keys!

StartSSL class 2 certificates allow wild-card, multiple domain, and code-signing certificates. Class 2 membership is not free, however it is a bargain at $59 per year. In addition, class 2 membership provides unlimited certificates (i.e., no revocation fees), and 3 year validation. The down side?

The class 2 identity verification is cumbersome.

The folks at StartSSL take integrity seriously (no joke). Be prepared to dig up corporate minutes; letters from your CEO; provide your license; provide proof of personal and corporate addresses; and public notary. My last mortgage was easier to obtain than my class 2 StartSSL membership. The renewal process is only slightly easier. To be fair, I must point out the irony of criticizing a public CA for their strong practice of integrity!

Assumptions:

StartSSL authenticates with personal certificates. The authentication process is different from most other web sites, which authenticates with usernames and passwords.
Mozilla FireFox is the preferred web browser for StartSSL management. Examples provided were created with FireFox.

Registration Process:

Register with StartSSL to receive your free personal certificate. The following steps explain how to register and authenticate.

1. Sign-up.

StartSSL certificates are available to anyone with a valid email address. Sign-up for a free StartSSL account at: https://startssl.com/?app=12.

Enrollment Details.

Provide your name, home and email address, and click submit. StartSSL sends a verification code to the registered email account. Enter the verification code and submit.

3. Generate Private Key.

The next step to the registration process generates a personal SSL certificate. All SSL certificates consist of a private key and a public key. The registration process creates a private key after the email address is verified. Choose High Grade and click Continue.

4. Install Certificate. Click on install:

5. Finish. The personal certificate is automatically installed into the user certificate store.

The personal SSL certificate is ready to authenticate user sessions on http://www.startssl.com. It is a good idea to backup (i.e., export) the personal certificate at this point.

Next Up: Part-two covers the StartSSL personal certificate authentication and management process.

How to Create a Self Signing Certificate

Outlook S/MIME Email Encryption

Import and Assign StartSSL Certificates in Windows, Part 4 of 4.

Setup StartSSL Certificates: Import and Assign StartSSL Certificates in Windows, Part 4 of 4.

New SSL Certificate: Generate a StartSSL Certificate, Part 3 of 4.

Setup StartSSL Certificates: Creating StartSSL Certificates, Part 3 of 4.

Back-up and Authenticate StartSSL Personal Certificates, Part 2 of 4

Setup StartSSL Certificates: Personal Certificate Authentication, Part 2 of 4.

Setup StartSSL Certificates, Part 1 of 4

Walk-through guide for StartSSL Certificates, Part 1 of 4.

CCNA Security Artifact Validation

Promote Enterprise Network Security Strategies.

Slow Authentication With Remote Terminal Services Gateway

My Instagram