CAcert - Revision history

PhilippeTeuwen: /* Personal notes */

2014-09-21T21:00:15Z

Personal notes

← Older revision		Revision as of 21:00, 21 September 2014
Line 49:		Line 49:
	** /etc/apache2/ssl/CAcert_chain.pem : renew it too if still using the md5-signed class 3, it's here: [http://wiki.cacert.org/wiki/SimpleApacheCert?action=AttachFile&do=get&target=CAcert_chain.pem CAcert_chain.pem]		** /etc/apache2/ssl/CAcert_chain.pem : renew it too if still using the md5-signed class 3, it's here: [http://wiki.cacert.org/wiki/SimpleApacheCert?action=AttachFile&do=get&target=CAcert_chain.pem CAcert_chain.pem]
	/etc/init.d/openvpn restart		/etc/init.d/openvpn restart

			* Global CA list:
			mkdir /usr/local/share/ca-certificates/cacert.org
			wget -P /usr/local/share/ca-certificates/cacert.org http://www.cacert.org/certs/root.crt http://www.cacert.org/certs/class3.crt
			update-ca-certificates

PhilippeTeuwen: /* Personal notes */

2014-03-24T22:39:31Z

Personal notes

← Older revision		Revision as of 22:39, 24 March 2014
Line 41:		Line 41:
	* IMAP config:		* IMAP config:
	** /etc/courier/imapd.pem Beware this file contains also the private key! Overwrite only the certificate section!		** /etc/courier/imapd.pem Beware this file contains also the private key! Overwrite only the certificate section!
	~~/etc/courier#~~ /etc/init.d/courier-authdaemon restart		/etc/init.d/courier-authdaemon restart
	/etc/init.d/courier-imap restart		/etc/init.d/courier-imap restart
	/etc/init.d/courier-imap-ssl restart		/etc/init.d/courier-imap-ssl restart

PhilippeTeuwen: /* Personal notes */

2014-03-24T22:39:17Z

Personal notes

← Older revision		Revision as of 22:39, 24 March 2014
Line 44:		Line 44:
	/etc/init.d/courier-imap restart		/etc/init.d/courier-imap restart
	/etc/init.d/courier-imap-ssl restart		/etc/init.d/courier-imap-ssl restart

			* OpenVPN config:
			** /etc/openvpn/myserver.pem
			** /etc/apache2/ssl/CAcert_chain.pem : renew it too if still using the md5-signed class 3, it's here: [http://wiki.cacert.org/wiki/SimpleApacheCert?action=AttachFile&do=get&target=CAcert_chain.pem CAcert_chain.pem]
			/etc/init.d/openvpn restart

PhilippeTeuwen at 22:37, 24 March 2014

2014-03-24T22:37:40Z

← Older revision		Revision as of 22:37, 24 March 2014
Line 28:		Line 28:
	assurer=ul.quote_plus('Philippe Y. F. Teuwen'); print 'https://secure.cacert.org/cap.php?name='\		assurer=ul.quote_plus('Philippe Y. F. Teuwen'); print 'https://secure.cacert.org/cap.php?name='\
	+name+'+&dob='+dob+'&email='+email+'&assurer='+assurer+'+&date=now&maxpoints=35'" "Firstname Lastname" yyyy-mm-dd email@address		+name+'+&dob='+dob+'&email='+email+'&assurer='+assurer+'+&date=now&maxpoints=35'" "Firstname Lastname" yyyy-mm-dd email@address
			==Personal notes==
			When renewing the certificate, change it in:
			* Apache config:
			** /etc/apache2/ssl/myserver.crt
			** /etc/apache2/ssl/CAcert_chain.pem : renew it too if still using the md5-signed class 3, it's here: [http://wiki.cacert.org/wiki/SimpleApacheCert?action=AttachFile&do=get&target=CAcert_chain.pem CAcert_chain.pem]
			/etc/init.d/apache2 restart

			* Exim config:
			** /etc/exim4/exim.crt
			/etc/init.d/exim4 restart

			* IMAP config:
			** /etc/courier/imapd.pem Beware this file contains also the private key! Overwrite only the certificate section!
			/etc/courier# /etc/init.d/courier-authdaemon restart
			/etc/init.d/courier-imap restart
			/etc/init.d/courier-imap-ssl restart

PhilippeTeuwen: /* Forms */

2013-07-04T20:12:32Z

Forms

← Older revision		Revision as of 20:12, 4 July 2013
Line 25:		Line 25:
	* [http://cert.startcom.org/ StartCom Free SSL Certification Authority]		* [http://cert.startcom.org/ StartCom Free SSL Certification Authority]
	==Forms==		==Forms==
	python -c "import sys, urllib as ul; name=ul.quote_plus(sys.argv[1]); dob=sys.argv[2]; email=ul.quote_plus(sys.argv[3]); assurer=ul.quote_plus('Philippe Y. F. Teuwen'); print 'https://secure.cacert.org/cap.php?name='+name+'+&dob='+dob+'&email='+email+'&assurer='+assurer+'+&date=now&maxpoints=35'" "Firstname Lastname" yyyy-mm-dd email@address		python -c "import sys, urllib as ul; name=ul.quote_plus(sys.argv[1]); dob=sys.argv[2]; email=ul.quote_plus(sys.argv[3]); \
			assurer=ul.quote_plus('Philippe Y. F. Teuwen'); print 'https://secure.cacert.org/cap.php?name='\
			+name+'+&dob='+dob+'&email='+email+'&assurer='+assurer+'+&date=now&maxpoints=35'" "Firstname Lastname" yyyy-mm-dd email@address

PhilippeTeuwen: /* Alternatives */

2013-07-04T20:11:46Z

Alternatives

← Older revision		Revision as of 20:11, 4 July 2013
Line 24:		Line 24:
	==Alternatives==		==Alternatives==
	* [http://cert.startcom.org/ StartCom Free SSL Certification Authority]		* [http://cert.startcom.org/ StartCom Free SSL Certification Authority]
			==Forms==
			python -c "import sys, urllib as ul; name=ul.quote_plus(sys.argv[1]); dob=sys.argv[2]; email=ul.quote_plus(sys.argv[3]); assurer=ul.quote_plus('Philippe Y. F. Teuwen'); print 'https://secure.cacert.org/cap.php?name='+name+'+&dob='+dob+'&email='+email+'&assurer='+assurer+'+&date=now&maxpoints=35'" "Firstname Lastname" yyyy-mm-dd email@address

PhilippeTeuwen: /* Misc infos */

2011-03-11T09:11:05Z

Misc infos

← Older revision		Revision as of 09:11, 11 March 2011
Line 16:		Line 16:
	SSLCertificateKeyFile <Path to your key file>/example_key.pem		SSLCertificateKeyFile <Path to your key file>/example_key.pem
	SSLCertificateChainFile <Path to your chain file>/CAcert_chain.pem		SSLCertificateChainFile <Path to your chain file>/CAcert_chain.pem
	* See [~~http~~://wiki.cacert.org~~/wiki~~/VhostTaskForce#~~head-5868dc7fb125370f7ae8931cd77f03aeb966ad53~~ here] for the csr.sh script to generate proper requests		* See [https://wiki.cacert.org/VhostTaskForce#Easy_way_to_generate_CSRs_with_subjectAltNames here] for the [http://guillaume.romagny.free.fr/evaldo/csr.sh csr.sh] script to generate proper requests
	* See [[Virtual_Private_Networks#Using_CACert_certificates_with_OpenVPN\|Using CACert certificates with OpenVPN]]		* See [[Virtual_Private_Networks#Using_CACert_certificates_with_OpenVPN\|Using CACert certificates with OpenVPN]]

	==old story==		==old story==
	* I tried to get the client certificate out of Firefox/Iceweasel as it repeatedly told me "Failed to create the PKCS #12 backup file for unknown reasons"<br>The bug is now solved: [http://bugs.debian.org/469079 #469079]: remove libnss3 and keep only libnss3-1d<br>		* I tried to get the client certificate out of Firefox/Iceweasel as it repeatedly told me "Failed to create the PKCS #12 backup file for unknown reasons"<br>The bug is now solved: [http://bugs.debian.org/469079 #469079]: remove libnss3 and keep only libnss3-1d<br>

PhilippeTeuwen: Reverted edits by Etegohy (Talk) to last revision by PhilippeTeuwen

2010-11-24T20:37:59Z

Reverted edits by Etegohy (Talk) to last revision by PhilippeTeuwen

Can't load revision 6889

at 08:22, 24 November 2010

2010-11-24T08:22:22Z

Can't load revision 6740

PhilippeTeuwen: /* Misc infos */

2010-04-22T16:01:38Z

Misc infos

← Older revision		Revision as of 16:01, 22 April 2010
Line 8:		Line 8:
	* [http://www.cacert.org/index.php?id=19 What can CAcert provide to you, to increase your privacy and security for free?]		* [http://www.cacert.org/index.php?id=19 What can CAcert provide to you, to increase your privacy and security for free?]
	* The [https://cats.cacert.org/education_2010.crt Education Client Certificate] I should use to encrypt my request for an official "paper" certificate (to have passed the test, not a digital certificate!)<br>I copied the link here as I could not right-click on their page to save it...		* The [https://cats.cacert.org/education_2010.crt Education Client Certificate] I should use to encrypt my request for an official "paper" certificate (to have passed the test, not a digital certificate!)<br>I copied the link here as I could not right-click on their page to save it...
	* ~~I tried to get~~ the client certificate out of Firefox/Iceweasel as ~~it repeatedly told me "Failed to create the~~ PKCS #12 backup file ~~for unknown reasons"<br>The bug is now identified~~ and ~~about to be solved: [http://bugs.debian.org/469079 #469079]: remove libnss3 and keep only libnss3-1d<br>To~~ convert it to PEM (here example without pwd for the key!)		* Get the client certificate out of Firefox/Iceweasel as PKCS #12 backup file and convert it to PEM (here example without pwd for the key!)
	openssl pkcs12 -in mycert.p12 -nocerts -nodes -out mycert.key.pem		openssl pkcs12 -in mycert.p12 -nocerts -nodes -out mycert.key.pem
	openssl pkcs12 -in mycert.p12 -clcerts -nokeys -out mycert.crt.pem		openssl pkcs12 -in mycert.p12 -clcerts -nokeys -out mycert.crt.pem
Line 18:		Line 18:
	* See [http://wiki.cacert.org/wiki/VhostTaskForce#head-5868dc7fb125370f7ae8931cd77f03aeb966ad53 here] for the csr.sh script to generate proper requests		* See [http://wiki.cacert.org/wiki/VhostTaskForce#head-5868dc7fb125370f7ae8931cd77f03aeb966ad53 here] for the csr.sh script to generate proper requests
	* See [[Virtual_Private_Networks#Using_CACert_certificates_with_OpenVPN\|Using CACert certificates with OpenVPN]]		* See [[Virtual_Private_Networks#Using_CACert_certificates_with_OpenVPN\|Using CACert certificates with OpenVPN]]
			==old story==
			* I tried to get the client certificate out of Firefox/Iceweasel as it repeatedly told me "Failed to create the PKCS #12 backup file for unknown reasons"<br>The bug is now solved: [http://bugs.debian.org/469079 #469079]: remove libnss3 and keep only libnss3-1d<br>

	==Alternatives==		==Alternatives==