<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi,<br>
<br>
On 21/01/22 11:29, Matthias Apitz wrote:<br>
</div>
<blockquote type="cite" cite="mid:YeqLHKFSpbldbMxT@c720-r368166">
<pre wrap="">
Hello,
we develop a business application as client/server with TCP/IP
communication and a human readable protocol, which is encrypted by
OpenSSL. The servers are C-written on top of PostgreSQL on Linux, while
the clients are mostly Java-written and running on Win10 PCs of the
staff, talking over the network to the servers. This runs well for many
years already. The clients have no key material and "trust" the server
servers. How the keys are made is explained below in some older post
from me. The connection establishment is from the client to the server.
This only as background for the actual situation.
What we now want to have is strengthen the communication in some
directions:
1) Each client should have its own key for the OpenSSL. They must be
built central, copied to the Win PC and installed there.
2) The usage of the key and OpenSSL communication should be protected by some
passphrase (like for a SSH connection the usage of the private RSA
key).
Is there some usecase example or some tutorial for this, or any other
hints?
</pre>
</blockquote>
<br>
yes, there is plenty of information on this out there, but the
tricky part is the fact that you are using Java on the client side.
Doing client authentication with Java requires knowledge of how Java
uses its local keystores. Example code can be found here:<br>
<a class="moz-txt-link-freetext" href="https://docs.oracle.com/javase/10/security/sample-code-illustrating-secure-socket-connection-client-and-server.htm">https://docs.oracle.com/javase/10/security/sample-code-illustrating-secure-socket-connection-client-and-server.htm</a><br>
<br>
You would set up a central PKI and issue passphrase protected keys
using it; the "openssl CA" commands are a good starting point for
this, otherwise I'd recommend looking into tools like "easy-rsa" ,
which are essentially wrappers around the "openssl CA" commands.<br>
<br>
On the server side you need to ensure that it will accept
connections only coming from clients that supply a certificate
signed by the CA you have built for this purpose. The OpenSSL
sources provide plenty of examples on how to do this.<br>
<br>
You'd then copy over the resulting client-side keys+certificates to
the Java-based client and import it into the Java keystore. That can
be done using the PKCS12 format, as I believe you can load a Java
keystore in that format, e.g.<br>
<pre><code class="language-java hljs">KeyStore ks = KeyStore.getInstance(<span class="hljs-string">"pcks12"</span>);</code></pre>
<br>
see <a class="moz-txt-link-freetext" href="https://www.baeldung.com/java-keystore">https://www.baeldung.com/java-keystore</a> for an example.<br>
<br>
HTH,<br>
<br>
JJK / Jan Just Keijser<br>
<br>
<br>
<br>
<blockquote type="cite" cite="mid:YeqLHKFSpbldbMxT@c720-r368166">
<pre wrap="">
----- Forwarded message from Matthias Apitz <a class="moz-txt-link-rfc2396E" href="mailto:guru@unixarea.de"><guru@unixarea.de></a> -----
Date: Tue, 19 Feb 2019 09:57:11 +0100
From: Matthias Apitz <a class="moz-txt-link-rfc2396E" href="mailto:guru@unixarea.de"><guru@unixarea.de></a>
To: <a class="moz-txt-link-abbreviated" href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>
Subject: understand 'openssl dhparms ....'
Hello,
Some years ago (in 2012) I wrote an OpenSSL server, loosely based on the example
sources 'openssl-examples-20020110' which nowadays still exist in
<a class="moz-txt-link-freetext" href="https://github.com/smbutton/DataCommProject/tree/master/openssl-examples-20020110/openssl-examples-20020110">https://github.com/smbutton/DataCommProject/tree/master/openssl-examples-20020110/openssl-examples-20020110</a>
There was also some guiding available about how to create the necessary
key material, which goes more or less like this:
--------------------------------------------------------------------------------
$ mkdir newca
$ cd newca
$ cp /usr/local/openssl/misc/CA.sh .
$ ./CA.sh -newca
will create a new CA. Remember the passphrase as you will need
it to sign certificates.
$ cp demoCA/cacert.pem ../root.pem
Second step
$ ./CA.sh -newreq
will create a certificate and a certification request.
Set the passphrase to 'password' as this is hard-coded in
the examples' source code. It is important to set the
[Common Name] to 'localhost'.
Third step
$ ./CA.sh -sign
will sign your newly created certificate. Enter the password for
your CA which you have defined in step 1.
Fourth step
$ cat newreq.pem newkey.pem newcert.pem > ../localhost.pem
$ cd ..
$ ln -s localhost.pem server.pem
$ ln -s localhost.pem client.pem
Maybe you also want to issue
$ openssl dhparam 1024 -2 -out dh1024.pem -outform PEM
in order to update the DH parameters.
...
--------------------------------------------------------------------------------
----- End forwarded message -----
</pre>
</blockquote>
<br>
</body>
</html>