Introduction
The Intershop 7 Apache web server is delivered with a dummy SSL certificate ("snakeoil" certificate / mod_ssl generated test server certificate). This SSL certificate is as invalid as possible:
- Certificate subject does not match the requested host name
- Certificate has expired
- Certificate is not signed by a trusted certification authority (CA)
The certificate still allows traffic to be encrypted, but cannot be used to verify the identity of the remote server (by design).
The original certificate has the following attributes:
| Field | Value |
|---|---|
| Version | V3 |
| Serial number | 06 |
| Signature algorithm | md5RSA |
| Signature hash algorithm | md5 |
| Issuer | C=XY, ST=Snake Desert, L=Snake Town, O=Snake Oil, Ltd, OU=Certificate Authority, CN=Snake Oil CA/emailAddress=ca@snakeoil.dom |
| Valid from | Aug 1 09:04:08 2002 GMT |
| Valid to | Aug 1 09:04:08 2003 GMT |
| Subject | C=XY, ST=Snake Desert, L=Snake Town, O=Snake Oil, Ltd, OU=Webserver Team, CN=www.snakeoil.dom/emailAddress=www@snakeoil.dom |
| Public key | RSA (1024 Bits): 30
81 89 02 81 81 00 d1 ea 39 c5 f7 98 04 f0 bd b4 21 e8 92 94 80 41 00 c7
a4 62 8d 7e 79 31 80 26 38 33 b5 f8 fd db 03 90 66 d6 4e c8 e7 d6 ae b7
ce f1 e4 4c f4 c9 d6 57 fc d0 46 1d 4d ea 1f 59 63 fb 54 03 94 e1 eb bd
8a f5 69 bf 7e 3f d1 3c 20 a5 46 93 74 25 e4 4e 54 b4 45 51 f3 7d 60 b3
77 63 42 26 b5 3e c9 16 17 17 de 02 9d 3b 5c f1 84 d0 84 d7 fc 95 8a 6f
5d 2a 44 8e fc 00 2a e8 b4 a8 bb fe 30 b9 02 03 01 00 01 |
| Subject Alternative Name | RFC822 Name=www@snakeoil.dom |
| Netscape Comment | mod_ssl generated test server certificate |
| Netscape Cert Type | SSL Server Authentication (40) |
| Thumbprint algorithm | sha1 |
| Thumbprint | 63 a7 d1 3c 97 f8 32 d9 f3 4d c5 8f 9c 77 bc 5a 39 b3 90 30 |
It was necessary to regenerate the dummy certificate because the signature hash algorithm (MD5) was disabled by a JDK update (considered insecure).
Step-by-Step Guide
The following steps are required to recreate the dummy SSL certificate (as close to the original certificate as possible). The commands have been tested on Windows; similar commands should work on Unix platforms as well.
The following list provide a quick overview of the steps required:
Install OpenSSL.
Copy openssl.cnf to httpd\conf.
Use this guide and use the local hostname for CN (Common Name) or the server name.
Import the certificate in the Java Keystore.
Restart the Apache.
For more use this detailed guide.
Open a developer shell; change to directory
%IS_HOME%\httpd:> cd /D %IS_HOME%\httpd
Create the certification authority directory structure, and initialize the index and serial files:
> mkdir demoCA\certs demoCA\crl demoCA\newcerts demoCA\private > type NUL > demoCA\index.txt > echo 07 > demoCA\serial
Adjust the conf\openssl.cnf settings (only changed properties listed):
[ usr_cert ] # basicConstraints=CA:FALSE # subjectKeyIdentifier=hash # authorityKeyIdentifier=keyid,issuer subjectAltName = email:copy nsComment = "mod_ssl generated test server certificate" nsCertType = server
Create the certification authority key and certificate:
> set OPENSSL_CONF=%IS_HOME%\httpd\conf\openssl.cnf > bin\openssl req -new -x509 -extensions v3_ca -newkey rsa:4096 -keyout demoCA\private\cakey.pem -out demoCA\cacert.pem -days 3650 Generating a 4096 bit RSA private key .........................................................++ .......................................................................................................................................................++ writing new private key to 'demoCA\private\cakey.pem' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:XY State or Province Name (full name) [Some-State]:Snake Desert Locality Name (eg, city) []:Snake Town Organization Name (eg, company) [Internet Widgits Pty Ltd]:Snake Oil, Ltd Organizational Unit Name (eg, section) []:Certificate Authority Common Name (e.g. server FQDN or YOUR name) []:localhost Email Address []:ca@snakeoil.domCreate a private key and a certificate signing request:
> bin\openssl req -new -nodes -newkey rsa:2048 -keyout conf\server.key -out server.csr -days 365 Generating a 2048 bit RSA private key .................................+++ .....+++ writing new private key to 'conf\server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:XY State or Province Name (full name) [Some-State]:Snake Desert Locality Name (eg, city) []:Snake Town Organization Name (eg, company) [Internet Widgits Pty Ltd]:Snake Oil, Ltd Organizational Unit Name (eg, section) []:Webserver Team Common Name (e.g. server FQDN or YOUR name) []:localhost Email Address []:www@snakeoil.dom Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:Sign the request using the certification authority:
> bin\openssl ca -policy policy_anything -out conf\server.crt -in server.csr -startdate 020801090408Z -enddate 030801090408Z Using configuration from D:\Projects\Engineering\intershop-trunk\server\local\httpd\conf\openssl.cnf Enter pass phrase for ./demoCA/private/cakey.pem: Check that the request matches the signature Signature ok Certificate Details: Serial Number: 7 (0x7) Validity Not Before: Aug 1 09:04:08 2002 Not After : Aug 1 09:04:08 2003 Subject: countryName = XY stateOrProvinceName = Snake Desert localityName = Snake Town organizationName = Snake Oil, Ltd organizationalUnitName = Webserver Team commonName = localhost emailAddress = www@snakeoil.dom X509v3 extensions: X509v3 Subject Alternative Name: email:www@snakeoil.dom Netscape Comment: mod_ssl generated test server certificate Netscape Cert Type: SSL Server Certificate is to be certified until Aug 1 09:04:08 2003 (-4644 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
The newly created certificate has the following attributes:
| Field | Value |
|---|---|
| Version | V3 |
| Serial number | 07 |
| Signature algorithm | sha256RSA |
| Signature hash algorithm | sha256 |
| Issuer | C=XY, ST=Snake Desert, L=Snake Town, O=Snake Oil, Ltd, OU=Certificate Authority, CN=localhost/emailAddress=ca@snakeoil.dom |
| Valid from | Aug 1 09:04:08 2002 |
| Valid to | Aug 1 09:04:08 2003 |
| Subject | C=XY, ST=Snake Desert, L=Snake Town, O=Snake Oil, Ltd, OU=Webserver Team, CN=localhost/emailAddress=www@snakeoil.dom |
| Public key | RSA (2048 Bits): 30
82 01 0a 02 82 01 01 00 aa 8e d0 e6 90 79 18 56 48 39 cd 47 17 af 35 43
61 9d d8 c6 f8 dd f6 7e cd f0 05 7a c6 4c ff 11 22 d8 e8 6f b9 58 54 53
6e 2b a6 ad 10 c6 03 29 3a 29 04 45 d4 9d 1f 5a ca bb 3f 88 fe 2c a9 08
22 9e 3f b0 5e 9e 45 41 8d 5d 30 08 62 a2 68 41 f0 44 2c 4b 19 18 63 90
10 6c 53 04 3f 63 5d c1 ae ef 5e 1d 22 b1 96 24 0a e6 14 b9 97 34 cd f0
ed 71 fa 5b 1c c4 46 85 e1 a8 a9 ba a5 69 7b 56 0b 65 cc 93 a7 53 f9 e2
55 b9 93 0f 29 8f d8 32 91 46 1b cc 6f 9b 00 a4 3a 0c ce fe f3 14 33 3a
56 1a fd 9c 85 73 43 cb 62 29 6a 8a bb fe 4f 6b 5c 67 60 8f 28 2a f8 20
70 fb bf 77 65 f8 f1 b5 1d 53 2d 5c 38 03 1f 65 17 6b ab de e1 b0 3d a7
03 fe ac bd 9a 22 3a b9 94 d6 f6 7d 29 f6 b0 0b e1 52 a7 ef 48 7e a6 ff
9f 4c f0 3e 9d ba 14 b7 26 e9 37 9a e5 99 76 bb 79 7b 13 b1 de ee 5b 41
02 03 01 00 01 |
| Subject Alternative Name | RFC822 Name=www@snakeoil.dom |
| Netscape Comment | mod_ssl generated test server certificate |
| Netscape Cert Type | SSL Server Authentication (40) |
| Thumbprint algorithm | sha1 |
| Thumbprint | 6c 7e 02 06 ed d6 7e 42 db a7 49 b2 d6 e7 59 53 5a 17 b8 ad |
Display Certificate Details
On Windows, you can use the certutil system command to view the contents of a certificate or certificate signing request:
The certificate / certificate signing request details can also be viewed using the openssl command (all platforms):
Related Articles
- Be your own Certificate Authority
OpenSSL - Cryptography and SSL/TLS Toolkit: OpenSSL command line tool manual page
- IS-13713 - Updated JDK limits allowed cryptografic algorithms