docs/security/TLS-configuration.md

123 openssl genrsa -out CA-key.pem 2048
131 openssl req -new -config openssl-client.cnf -key CA-key.pem -x509 -days 1000 -out CA-cert.pem
142 openssl genrsa -out client-key.pem 2048
152 openssl req -new -config openssl-client.cnf -key client-key.pem -out signingReqClient.csr
155 Sign the certificate using your `CA-cert.pem` certificate with following
159 …-days 365 -in signingReqClient.csr -CA CA-cert.pem -CAkey CA-key.pem -CAcreateserial -out client-c…
162 The file `client-cert.pem` now contains a signed client certificate.
174 openssl genrsa -out server-key.pem 2048
186 openssl req -new -config openssl-server.cnf -key server-key.pem -out signingReqServer.csr
189 Sign the certificate using your `CA-cert.pem` certificate with following
193 …-days 365 -in signingReqServer.csr -CA CA-cert.pem -CAkey CA-key.pem -CAcreateserial -out server-c…
196 The file `server-cert.pem` now contains a signed server certificate.
204 openssl x509 -in CA-cert.pem -text -noout
205 openssl x509 -in client-cert.pem -text -noout
206 openssl x509 -in server-cert.pem -text -noout
215 - `Issuer` in `client-cert.pem`, it must match to `Subject` in `CA-cert.pem`,
216 - Section _X509v3 extensions_ in `client-cert.pem` it should contain proper
219 - `Subject` CN in `client-cert.pem`, it should match existing OpemBMC user name.
221 - `Subject` CN in `server-cert.pem`, it should match OpemBMC host name. In this
228 CA-cert.pem
263 client-cert.pem
298 server-cert.pem
334 The CA certificate can be installed via Redfish Service. The file `CA-cert.pem`
344   "CertificateString":"$(cat CA-cert.pem | sed -n -e '1h;1!H;${x;s/\n/\\n/g;p;}')",
345   "CertificateType": "PEM"
380 …"CertificateString":"$(cat server-key.pem server-cert.pem | sed -n -e '1h;1!H;${x;s/\n/\\n/g;p;}')…
385   "CertificateType": "PEM"
432 curl --cert client-cert.pem --key client-key.pem -vvv --cacert CA-cert.pem https://${bmc}/redfish/v…