Difference between revisions of "PKI ACME Service"

From Dogtag
Jump to: navigation, search
m (Setting up NSS Database)
m (Installation)
 
(18 intermediate revisions by the same user not shown)
Line 1: Line 1:
= Current Issues =
+
= Overview =
  
* The certbot generates CSR with empty subject, but the caServerCert profile requires a subject that starts with CN=.
+
This page describes the procedure to install PKI ACME Service being developed for PKI 10.8.
* PKI CA requires authentication with admin's client cert.
 
* Bug in CertificatePoliciesExtDefault.
 
  
= Installing PKI CA =
+
The development branch is available at:
  
See [[Installing CA]].
+
* https://github.com/edewata/pki/commits/acme
  
= Creating ACME Service =
+
= Current Issues =
  
To create ACME service:
+
* The certbot generates CSR with empty subject, but the caServerCert profile requires a subject that starts with CN=.
 
 
<pre>
 
$ pki-server acme-create --database <database> --backend <backend>
 
</pre>
 
 
 
It will store the configuration files in /etc/pki/<font color="red">pki-tomcat</font>/acme folder.
 
Make sure the ACME subsystem is configured to point to PKI CA.
 
 
 
= Configuring NSS Database =
 
 
 
<pre>
 
$ pki-server nss-create -i tomcat@acme --no-password
 
$ pki-server jss-enable -i tomcat@acme
 
</pre>
 
 
 
To import Let's Encrypt's CA certificates:
 
 
 
* [https://letsencrypt.org/certs/isrgrootx1.pem.txt ISRG Root X1]
 
* [https://letsencrypt.org/certs/trustid-x3-root.pem.txt DST Root CA X3]
 
 
 
$ wget https://letsencrypt.org/certs/isrgrootx1.pem.txt
 
$ certutil -A -d /etc/pki/<font color="red">pki-tomcat</font>/alias -i isrgrootx1.pem.txt -n "ISRG Root X1" -t CT,C,C
 
$ wget https://letsencrypt.org/certs/trustid-x3-root.pem.txt
 
$ certutil -A -d /etc/pki/<font color="red">pki-tomcat</font>/alias -i trustid-x3-root.pem.txt -n "DST Root CA X3" -t CT,C,C
 
 
 
= Configuring TLS =
 
 
 
<pre>
 
$ pki-server http-connector-add -i tomcat@acme \
 
  --port 8443 \
 
  --scheme https \
 
  --secure true \
 
  --sslEnabled true \
 
  --sslProtocol SSL \
 
  Secure
 
$ pki-server http-connector-mod -i tomcat@acme \
 
  --sslImpl org.dogtagpki.tomcat.JSSImplementation \
 
  Secure
 
$ pki-server http-connector-cert-add -i tomcat@acme \
 
  --keyAlias sslserver \
 
  --keystoreType pkcs11 \
 
  --keystoreProvider Mozilla-JSS
 
</pre>
 
 
 
= Configuring Metadata =
 
 
 
The ACME service metadata configuration is located at /etc/pki/<font color="red">pki-tomcat</font>/acme/metadata.xml:
 
 
 
<pre>
 
<metadata>
 
    <termsOfService>https://example.com/acme/docs/tos.pdf</termsOfService>
 
    <website>https://www.example.com/</website>
 
    <caaIdentities>example.com</caaIdentities>
 
    <externalAccountRequired>false</externalAccountRequired>
 
</metadata>
 
</pre>
 
 
 
= Configuring ACME Database =
 
 
 
The ACME database configuration is located at /etc/pki/<font color="red">pki-tomcat</font>/acme/database.xml.
 
 
 
* PKI ACME Service with Memory Database
 
* PKI ACME Service with LDAP Database
 
* [[PKI ACME Service with Mongo Database]]
 
 
 
= Configuring ACME Backend =
 
 
 
The ACME backend configuration is located at /etc/pki/<font color="red">pki-tomcat</font>/acme/backend.xml.
 
 
 
* [[PKI ACME Service with PKI Backend]]
 
* [[PKI ACME Service with OpenSSL Backend]]
 
* [[PKI ACME Service with Proxy Backend]]
 
 
 
= Deploying ACME Web Application =
 
 
 
To deploy ACME web application:
 
  
<pre>
+
= Installation =
$ pki-server acme-deploy
 
</pre>
 
  
It will create a deployment descriptor at /etc/pki/<font color="red">pki-tomcat</font>/Catalina/localhost/acme.xml.
+
* [[Installing Standalone ACME Service]]
 
+
* [[Installing ACME Service in PKI CA]]
To verify, open the ACME service in a browser, for example:
+
* [[Configuring ACME Service]]
 
 
* https://acme.demo.dogtagpki.org/acme/directory
 
  
 
= Certificate Enrollment =
 
= Certificate Enrollment =
Line 177: Line 95:
  
 
* [https://letsencrypt.org/docs/revoking/ Revoking certificates]
 
* [https://letsencrypt.org/docs/revoking/ Revoking certificates]
 
= Undeploying ACME Web Application =
 
 
To undeploy ACME web application:
 
 
<pre>
 
$ pki-server acme-undeploy
 
</pre>
 
 
= Removing ACME Subsystem =
 
 
To remove ACME subsystem:
 
 
<pre>
 
$ pki-server acme-remove
 
</pre>
 
  
 
= See Also =
 
= See Also =

Latest revision as of 21:05, 14 November 2019

Overview

This page describes the procedure to install PKI ACME Service being developed for PKI 10.8.

The development branch is available at:

Current Issues

  • The certbot generates CSR with empty subject, but the caServerCert profile requires a subject that starts with CN=.

Installation

Certificate Enrollment

HTTP-01 Challenge

To request a certificate with automatic http-01 challenge:

$ certbot certonly --standalone \
    -d server.example.com \
    --server https://acme.demo.dogtagpki.org/acme/directory \
    --preferred-challenges http \
    --register-unsafely-without-email

To request a certificate with manual http-01 validation:

$ certbot certonly --manual \
    -d server.example.com \
    --server https://acme.demo.dogtagpki.org/acme/directory \
    --preferred-challenges http \
    --register-unsafely-without-email

Make sure the web server is set up properly:

$ curl http://server.example.com/.well-known/acme-challenge/<token>

DNS-01 Challenge

To request a certificate with manual dns-01 challenge:

$ certbot certonly --manual \
    -d server.example.com \
    --server https://acme.demo.dogtagpki.org/acme/directory \
    --preferred-challenges dns \
    --register-unsafely-without-email

Make sure the TXT record is created properly:

$ dig _acme-challenge.server.example.com TXT

The certificate will be stored at /etc/letsencrypt/live/server.example.com/cert.pem.

To inspect the certificate:

$ openssl x509 -text -noout -in /etc/letsencrypt/live/server.example.com/cert.pem

Certificate Revocation

To revoke with ACME account:

$ certbot revoke \
    --cert-path /etc/letsencrypt/live/server.example.com/cert.pem \
    --server https://acme.demo.dogtagpki.org/acme/directory

To revoke with private key:

$ certbot revoke \
    --cert-path /etc/letsencrypt/live/server.example.com/cert.pem \
    --key-path /etc/letsencrypt/live/server.example.com/privkey.pem \
    --server https://acme.demo.dogtagpki.org/acme/directory

See also:

See Also