<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On 1 April 2015 at 20:02, Nalin Dahyabhai <span dir="ltr"><<a href="mailto:nalin@redhat.com" target="_blank">nalin@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">On Wed, Apr 01, 2015 at 07:02:56PM +0200, Andrew Holway wrote:<br>
> I understand from previous discussions that client certificates are not yet<br>
> supported in FreeIPA, instead I understand one can use "service<br>
> certificates". From an OpenVPN standpoint I'm guessing this is fine because<br>
> a vpn client can be entered in Freeipa as a client and a certificate<br>
> generated for it. This might actually be a preferred model for VPN.<br>
><br>
> My OVPN server config looks like this:<br>
> ca ca.crt<br>
> cert server.crt<br>
> key server.key<br>
> # Diffie hellman parameters.<br>
> dh dh2048.pem<br>
><br>
> I guess I can use the<br>
> "ipa-getcert request -f /path/to/server.crt -k /path/to/private.key -r"<br>
> command to generate the server.crt and private.key and I know where to find<br>
> ca.crt however:<br>
<br>
</span>Unless there are other requirements on the contents of the certificate,<br>
I'd expect that to work.<br></blockquote><div><br></div><div>
<p class="">ipa service-add-host --hosts <a href="http://ipa.domain.de">ipa.domain.de</a> client/<a href="http://andrews-macbook-air.local.domain.de">andrews-macbook-air.local.domain.de</a></p><p class="">
</p><p class="">ipa-getcert request -f /var/lib/certmonger/requests/Andrews-MacBook-Air.local.crt -k /var/lib/certmonger/requests/Andrews-MacBook-Air.local.key -N CN=<a href="http://andrews-macbook-air.local.domain.de">andrews-macbook-air.local.domain.de</a> -D <a href="http://andrews-macbook-air.local.domain.de">andrews-macbook-air.local.domain.de</a> -K client/<a href="mailto:andrews-macbook-air.local.domain.de@DOMAIN.DE">andrews-macbook-air.local.domain.de@DOMAIN.DE</a></p><p class="">-- Then shuffle the keys and certs around -- </p><p class="">-- Restart OpenVPN --</p><p class="">And et voila! It works! Although it does feel a bit hacky :)</p></div><div><br></div><div><br></div><div>The GUI has some weird advice that did not make much sense when I did: Actions -> New Certificate:</div><div><br></div>Issue New Certificate for Host <a href="http://andrews-macbook-air.local.domain.de">andrews-macbook-air.local.domain.de</a><br><br>Create a certificate database or use an existing one. To create a new database:<br># certutil -N -d <database path><br>Create a CSR with subject CN=<hostname>,O=<realm>, for example:<br># certutil -R -d <database path> -a -g <key size> -s 'CN=<a href="http://andrews-macbook-air.local.otternetworks.de">andrews-macbook-air.local.otternetworks.de</a>,O=<a href="http://OTTERNETWORKS.DE">OTTERNETWORKS.DE</a>'<br>Copy and paste the CSR (from -----BEGIN NEW CERTIFICATE REQUEST----- to -----END NEW CERTIFICATE REQUEST-----) into the text area below:<div><br></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
I see mention in the docs of optionally requiring that a peer<br>
certificate include a particular value in its nsCertType extension<br>
(support for that's not currently planned AFAIK), or a particular value<br>
in its extendedKeyUsage (EKU) extension (there's a ticket [1] for<br>
supporting that), but you're not setting such a requirement above.<br>
<span class=""><br>
> - How about the Diffie hellman parameters?<br>
> - Is dh2048.pem just a bunch of shared primes that enable the two parties<br>
> to establish encryption together?<br>
<br>
</span>Yes to both. I'm going by the PKI section of the howto [2] and the man<br>
page here.<br>
<span class=""><br>
> - Is it bad If this file is compromised?<br>
<br>
</span>The howto and man pages say it's not required to be kept secret, and the<br>
secrecy of a key that's generated using DH key agreement doesn't depend<br>
on the parameters being kept secret, so I'd say no.<br>
<br>
HTH,<br>
<br>
Nalin<br>
<br>
[1] <a href="https://fedorahosted.org/freeipa/ticket/2915" target="_blank">https://fedorahosted.org/freeipa/ticket/2915</a><br>
[2] <a href="https://openvpn.net/index.php/open-source/documentation/howto.html#pki" target="_blank">https://openvpn.net/index.php/open-source/documentation/howto.html#pki</a><br>
</blockquote></div><br></div></div>