So richtig kapiert hab ich das auch noch nicht aber bei mir hab ich folgendes gemacht:
RedHat 8.0
Pakete openssl und openssl-devel müssen installiert sein.
cd /usr/share/ssl/certs
openssl req -config openssl.cnf -new -out my-zertifikat.csr
openssl rsa -in privkey.pem -out my-zertifikat.key
openssl x509 -in my-zertifikat.csr -out my-zertifikat.crt -req -signkey my-zertifikat.key -days 365
openssl x509 -in my-zertifikat.crt -out my-zertifikat.der.crt -outform DER
Die
/usr/share/ssl/certs/openssl.cnf muß so ungefähr aussehen
#
# OpenSSL configuration file.
#
# Establish working directory.
dir = .
[ ca ]
default_ca = CA_default
[ CA_default ]
serial = $dir/serial
database = $dir/certindex.txt
new_certs_dir = $dir/certs
certificate = $dir/cacert.pem
private_key = $dir/private/cakey.pem
default_days = 365
default_md = md5
preserve = no
email_in_dn = no
nameopt = default_ca
certopt = default_ca
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
default_bits = 1024 # Size of keys
default_keyfile = key.pem # name of generated keys
default_md = md5 # message digest algorithm
string_mask = nombstr # permitted characters
distinguished_name = req_distinguished_name
req_extensions = v3_req
[ req_distinguished_name ]
# Variable name Prompt string
#---------------------- ----------------------------------
0.organizationName = Organization Name (company)
organizationalUnitName = Organizational Unit Name (department, division)
emailAddress = Email Address
emailAddress_max = 40
localityName = Locality Name (city, district)
stateOrProvinceName = State or Province Name (full name)
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
commonName = Common Name (hostname, IP, or your name)
commonName_max = 64
# Default values for the above, for consistency and less typing.
# Variable name Value
#------------------------------ ------------------------------
0.organizationName_default = My Company
localityName_default = My Town
stateOrProvinceName_default = State or Providence
countryName_default = US
[ v3_ca ]
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
[ v3_req ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
In die
proftpd.confTLSEngine on
TLSLog /var/log/proftpd_tls.log
TLSProtocol TLSv1
# Are clients required to use FTP over TLS when talking to this server?
TLSRequired on
# Server's certificate
TLSRSACertificateFile /usr/share/ssl/certs/my-zertifikat.crt
TLSRSACertificateKeyFile /usr/share/ssl/certs/my-zertifikat.key
# CA the server trusts
TLSCACertificateFile /usr/share/ssl/certs/privkey.pem
# Authenticate clients that want to use FTP over TLS?
TLSVerifyClient on
Irgendwie ging's dann :roll:
