| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960 |
- In order to use the certificate to authenticate a web service, it needs to be
- exported from TinyCA and copied to a location where your server can find it. To
- be more precise, the files we'll export are:
- - __CA certificate__: This file can (and should) be made public safely. Clients
- will need to have it installed in order for their software to trust the
- certificates signed by your CA.
- - __Revocation list__: This file should be made available at the address you
- specified while configuring the CA. It will allow you later to revoke
- signatures, e.g. if a certificate was misused.
- - __Server certificate__: This file can be safely made public, but you don't
- need to send it to clients. It is one of the files you'll need to make
- available to the servers you run, in order for them to work with SSL.
- - __Server key__: This file __IS PRIVATE__. Protect it with proper permissions!
- Make it read-only, and preferrably owned by root. Some servers (such as
- lighttpd) access it while being root, so `chmod 400` and `chown root:root` is
- the best thing to do, when possible. It depends on the implementation of each
- server. The server key needs to be available to the server together with the
- server certificate.
- Another commonly used file is the __CA chain file__, but it is only required
- when you use sub-CAs. Since in our setup there aren't any, and the root CA signs
- the server certificates directly, no chain file is needed.
- Let's export the CA certificate. In the main window of TinyCA, click the "Export
- CA Certificate" toolbar button, which is the second from the right (or left, if
- you use an RTL locale). Choose a location to export to. Example:
- [[!img 6-export-ca-cert.png class="center"]]
- In order to export the revocation list, click the right most button (or left
- most, if you use an RTL locale) on the toolbar. Choose a location, enter the CA
- password and validity time. You can probably use the default for now, but I'm
- not an expert. If you need advice on expiration times, I hope other resources
- can help. If you do know, please share it here if you can, to make this guide
- more complete.
- [[!img 7-export-crl.png class="center"]]
- In order to export the server certificate, go to the Certificates tab and
- right-click on the certificate line. Choose "Export Certificate" from the popup
- menu.
- [[!img 8.1-export-cert-menu.png class="center"]]
- Choose a storage location and click "Save".
- [[!img 8.2-export-cert-filled-nokey.png class="center"]]
- Finally, in order to export the server key, go to the Keys tab. Right-click on
- the key line and select "Export Key".
- [[!img 9.1-export-key-menu.png class="center"]]
- Choose a storage location. Set "Without Passphrase" to yes, otherwise you'll
- need to supply the key passphrase every time you start the web server. Click
- "Save". You will be asked for the certificate passphrase.
- [[!img 9.2-export-key-filled-nocert.png class="center"]]
|
