obvi.us

This page was last updated in 2016-10. General information is approximately correct, but there may be errors in the finer points. Also technology has improved, attacks have improved, companies have come (Let's Encrypt) and gone (Symantec).

Contents: Subject Alternative Name, Server Name Indication, S/MIME, Client Certificates, PGP, Pans CA, .

Subject Alternative Name

The X.509 Subject Alternative Name (SAN) extension to a certificate allows your server to be addressed by different names without throwing certificate errors. If your site can be known by more than one name, for example, people type an unqualified host name in the intranet, then you will want to use Subject Alternative Name extensions to make their life more trustworthy.

Server Name Indication

How many IPv4 addresses are there? Not enough, and they're all allocated. So if you're going to pack multiple HTTPS sites onto one IP address then you'll need to use a Server Name Indication in the Client Hello. What does that mean? Good question. Allow me to explain (or simply hire me to explain).

S/MIME

S/MIME is a way to sign and/or encrypt email from one person to another. Only the recipient can read the encrypted email, and only the sender can stamp their signature onto the email. This has the benefit of stopping people from snooping on the email in transit, as well as preventing someone without the private key from reading the email, even if they steal it off a mail server along the way.

Client Certificates

With a client certificate, as issued by Comodo or CACert.org, you can identify yourself to websites that ask for a client certificate and you can sign your own email. Software support varies.

Visit their website to get started.

You can also generate a client certificate by hand and either self-sign it or send it to someone else for signing.

PGP / GnuPG

PGP operates much the same way as S/MIME and the Certificate Authority works, except the algorithms and authors are different, the software support is different, and the distribution of keys is different. The underlying mathematics and the way it protects your mail in transit and at rest is identical.

Whilst you need to generate a client certificate in your browser or with OpenSSL/LibreSSL and then have it signed by a certificate authority (usually for a fee), all of PGP is free and there is no central authority. The only people who trust you are those you've met and verified in person.

Here is this author's GPG fingerprint and public key. You can track this on keybase.io/tipene:

pub   4096R/B3B4BBF5 2014-06-13 [expires: 2019-06-12]
      Key fingerprint = 40DD 95E4 4778 0BA2 8B0E  7C08 6E1F 88E4 B3B4 BBF5
uid                  Stephen D. Cope <gpg sdc org nz>
sub   4096R/6F6A3CF3 2014-06-13 [expires: 2019-06-12]

You can import this into your keychain by doing something convenient and potentially dangerous such as one of the following:

1# lynx -dump https://obvi.us/crypto/ | gpg --import
2# gpg --recv-keys B3B4BBF5

The first option dumps this webpage into gpg, and gpg sees this next block and imports it into your keyring. The second option contacts a local keyserver and grabs my public key from there. Since you're on this page the first option is the best.

After this you'll need to ring me, verify my identity, and then we can verify this fingerprint before you trust my certificate. If you trust me, please sign it and upload the proof.

Verification

If you're signing my key because you trust me and have verified that it is indeed mine, please upload it to a keyserver so we can all enjoy the web of trust. Thanks!

Please ring me to verify the GPG fingerprint above. The key can be found on all good keyservers.

Once you trust me and trust my key, make sure you inform GPG by locally signing it. Then you can use it to verify other files and messages I have signed.

# gpg --sign-key B3B4BBF5
# gpg --send-keys B3B4BBF5

Another link

Cryptography and PKI Tutorial by Lawrence Hughes

Certificate Authorities

Not so long ago this page explained how one could install the Pans CA (Certificate Authority) on your computer. I leave this here as a general purpose way to install a Certificate Authority of your choice onto Linux. Before I ran Pans CA I ran Snap CA, and before that I ran one a previous employer.

I have run various Certificate Authorities from until late 2014. The work done by CACert.org and Let's Encrypt is excellent so there is no longer any need for me to run my own authority. Install the CACert.org root (if you trust them - don't take my word for it) and use them to your heart's content.

To install your own certificate authority, download the CA's public key, eg, CACert.org Class 1 PKI root.

On Ubuntu 13 or 14: Place the file into /etc/ssl/certs/ and then run 'sudo c_rehash'. This creates symlinks to it, and then wget, curl and other commands no longer complain.

On Redhat/CentOS 5: Place the file into /etc/pki/tls/certs/ and then append its contents to /etc/pki/tls/cert.pem

For Firefox, Internet Explorer, Android, etc, they should prompt you for what you want to do when you install the certificate.

Did I mention that you must be absolutely sure you have the right file before you install it?

Are you interested in crypto?

Make your own client certificate.

Would you like to add ChaCha20 support to your website? Add ChaCha20 to your website!

Switching out OpenSSL for LibreSSL is easy.