Managing certificates using OpenXPKI Certificate Authority

This section provides instructions on how to configure OpenXPKI CA version 2.5.x using Simple Certificate Enrollment Protocol (SCEP).

Notes:

Make sure that you are using the Debian 8 Jessie operating system.
For more information on OpenXPKI, go to www.openxpki.org.

Configuring OpenXPKI CA

Installing OpenXPKI CA

Connect the machine using PuTTY or another client.
From the client, run the sudo su - command to go to the root user.
Enter the root password.
In nano /etc/apt/sources.list, change the source for installing the updates.

Update the file. For example:

#

# deb cdrom:[Debian GNU/Linux 8.11.1 _Jessie_ - Official amd64 CD Binary-1 20190211-02:10]/ jessie local main
# deb cdrom:[Debian GNU/Linux 8.11.1 _Jessie_ - Official amd64 CD Binary-1 20190211-02:10]/ jessie local main

deb http://security.debian.org/ jessie/updates main
deb-src http://security.debian.org/ jessie/updates main

# jessie-updates, previously known as 'volatile'
# A network mirror was not selected during install.  The following entries
# are provided as examples, but you should amend them as appropriate
# for your mirror of choice.
#
deb http://ftp.debian.org/debian/jessie-updates main
deb-src http://ftp.debian.org/debian/jessie-updates main
deb http://ftp.us.debian.org/debian/jessie main

Save the file.
Run the following commands:
- apt-get update
- apt-get upgrade
Update the CA certificate lists in the server using apt-get install ca-certificates.
Install en_US.utf8 locale using dpkg-reconfigure locales.
Select the en_US.UTF-8 UTF-8 locale, and then make it the default locale for the system.
Note: Use the Tab and spacebar keys for selecting and navigating the menu.
Check the locales that you have generated using locale –a.
Sample output
```
C
C.UTF-8
en_IN
en_IN.utf8
en_US.utf8
POSIX
```
Copy the fingerprint of the OpenXPKI package using nano /home/Release.key. For this instance, copy the key in /home.
Type 9B156AD0 F0E6A6C7 86FABE7A D8363C4E 1611A2BE 2B251336 01D1CDB4 6C24BEF3 as the value.
Run the following command:
gpg --print-md sha256 /home/Release.key
Add the package using the wget https://packages.openxpki.org/v2/debian/Release.key -O - | apt-key add - command.
Add the repository to your source list (jessie) using echo "deb http://packages.openxpki.org/v2/debian/jessie release" > /etc/apt/sources.list.d/openxpki.list, and then aptitude update.
Install MySQL and Perl MySQL binding using aptitude install mysql-server libdbd-mysql-perl.
Install apache2.2-common using aptitude install apache2.2-common.
In nano /etc/apt/sources.list, install the fastcgi module to speed up the user interface.
Note: We recommend using mod_fcgid.
Add the deb http://http.us.debian.org/debian/jessie main line in the file, and then save it.
Run the following commands:
apt-get update
aptitude install libapache2-mod-fcgid
Enable the fastcgi module using a2enmod fcgid.
Install the OpenXPKI core package using aptitude install libopenxpki-perl openxpki-cgi-session-driver openxpki-i18n.
Restart the Apache server using service apache2 restart.
Check whether the installation is successful using openxpkiadm version.
Note: If the installation is successful, then the system shows the version of the installed OpenXPKI. For example, Version (core): 2.5.5.
Create the empty database, and then assign the database user using mysql -u root –p.
Notes:
- This command must be typed in the client. Otherwise, you cannot enter the password.
- Type the password for the MySQL. For this instance, root is the MySQL user.
- openxpki is the user on which OpenXPKI is installed.
```
CREATE DATABASE openxpki CHARSET utf8; 
CREATE USER 'openxpki'@'localhost' IDENTIFIED BY 'openxpki';
GRANT ALL ON openxpki.* TO 'openxpki'@'localhost';
flush privileges;
```
If the MySQL service is not running, then run /etc/init.d/mysql start to start the service.
Type quit to exit from MySQL.
Store the used credentials in /etc/openxpki/config.d/system/database.yaml.
Sample file content
```
debug: 0
type: MySQL
name: openxpki
host: localhost
port: 3306
user: openxpki 
passwd: openxpki
```
Note: Change user and passwd to match the MySQL user name and password.
Save the file.
For empty database schema, run zcat /usr/share/doc/libopenxpki-perl/examples/schema-mysql.sql.gz | \mysql -u root --password --database openxpki from the provided schema file.
Enter the password for the database.

Configuring OpenXPKI CA using default script

Note: The default script configures only the default realm, ca-one. The CDP and CRLs are not configured.

Unzip the sample script for installing the certificate using gunzip -k /usr/share/doc/libopenxpki-perl/examples/sampleconfig.sh.gz.
Run the script using bash /usr/share/doc/libopenxpki-perl/examples/sampleconfig.sh.

Confirm the setup using openxpkiadm alias --realm ca-one.

Sample output

=== functional token ===
scep (scep):
Alias    : scep-1
Identifier: YsBNZ7JYTbx89F_-Z4jn_RPFFWo
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2016-01-30 20:44:40

vault (datasafe):
Alias    : vault-1
Identifier: lZILS1l6Km5aIGS6pA7P7azAJic
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2016-01-30 20:44:40

ca-signer (certsign):
Alias    : ca-signer-1
Identifier: Sw_IY7AdoGUp28F_cFEdhbtI9pE
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2018-01-29 20:44:40

=== root ca ===
current root ca:
Alias     : root-1
Identifier: fVrqJAlpotPaisOAsnxa9cglXCc
NotBefore : 2015-01-30 20:44:39
NotAfter  : 2020-01-30 20:44:39

upcoming root ca:
  not set

Check whether the installation is successful using openxpkictl start.
Sample output
```
Starting OpenXPKI...
OpenXPKI Server is running and accepting requests.
DONE.
```
Do the following to access the OpenXPKI server:
1. From a web browser, type http://ipaddress/openxpki/.
2. Log in as Operator. The default password is openxpki.
  Note: The Operator login has two preconfigured operator accounts, raop and raop2.
Create one certificate request, and then test it.

Configuring OpenXPKI CA manually

Overview

Note: Before you begin, make sure that you have a basic knowledge on creating OpenSSL certificates.

To configure OpenXPKI CA manually, create the following:

Root CA certificate. For more information, see Creating a root CA certificate.
CA signer certificate, signed by the root CA. For more information, see Creating a signer certificate.
Data vault certificate, self-signed. For more information, see Creating a vault certificate.
SCEP certificate, signed by the signer certificate.

Notes:

When selecting the signature hash, use either SHA256 or SHA512.
Changing the public key size is optional.

For this instance, we are using the /etc/certs/openxpki_ca-one/ directory for certificate generation. However, you can use any directory.

Creating an OpenSSL configuration file

Run the following command:

nano /etc/certs/openxpki_ca-one/openssl.conf

Note: If your server is reachable using the fully qualified domain name (FQDN), then use the DNS of the server instead of its IP address.

Sample file

# x509_extensions               = v3_ca_extensions
# x509_extensions               = v3_issuing_extensions
# x509_extensions               = v3_datavault_extensions
# x509_extensions               = v3_scep_extensions
# x509_extensions               = v3_web_extensions
# x509_extensions               = v3_ca_reqexts # not for root self-signed, only for issuing
## x509_extensions              = v3_datavault_reqexts # not required self-signed
# x509_extensions               = v3_scep_reqexts
# x509_extensions               = v3_web_reqexts

[ req ]
default_bits            = 4096
distinguished_name      = req_distinguished_name

[ req_distinguished_name ]
domainComponent         = Domain Component
commonName              = Common Name

[ v3_ca_reqexts ]
subjectKeyIdentifier    = hash
keyUsage                = digitalSignature, keyCertSign, cRLSign

[ v3_datavault_reqexts ]
subjectKeyIdentifier    = hash
keyUsage                = keyEncipherment
extendedKeyUsage        = emailProtection

[ v3_scep_reqexts ]
subjectKeyIdentifier    = hash

[ v3_web_reqexts ]
subjectKeyIdentifier    = hash
keyUsage                = critical, digitalSignature, keyEncipherment
extendedKeyUsage        = serverAuth, clientAuth

[ v3_ca_extensions ]
subjectKeyIdentifier    = hash
keyUsage                = digitalSignature, keyCertSign, cRLSign
basicConstraints        = critical,CA:TRUE
authorityKeyIdentifier  = keyid:always,issuer

[ v3_issuing_extensions ]
subjectKeyIdentifier    = hash
keyUsage                = digitalSignature, keyCertSign, cRLSign
basicConstraints        = critical,CA:TRUE
authorityKeyIdentifier  = keyid:always,issuer:always
crlDistributionPoints   = URI:http://FQDN of the server/CertEnroll/MYOPENXPKI.crl
authorityInfoAccess     = caIssuers;URI:http://FQDN of the server/CertEnroll/MYOPENXPKI.crt

[ v3_datavault_extensions ]
subjectKeyIdentifier    = hash
keyUsage                = keyEncipherment
extendedKeyUsage        = emailProtection
basicConstraints        = CA:FALSE
authorityKeyIdentifier  = keyid:always,issuer

[ v3_scep_extensions ]
subjectKeyIdentifier    = hash
basicConstraints        = CA:FALSE
authorityKeyIdentifier  = keyid,issuer

[ v3_web_extensions ]
subjectKeyIdentifier    = hash
keyUsage                = critical, digitalSignature, keyEncipherment
extendedKeyUsage        = serverAuth, clientAuth
basicConstraints        = critical,CA:FALSE
subjectAltName          = DNS:stlopenxpki.dhcp.indiadev.lexmark.com
crlDistributionPoints   = URI:http://FQDN of the server/CertEnroll/MYOPENXPKI_ISSUINGCA.crl
authorityInfoAccess     = caIssuers;URI:http://FQDN of the server/CertEnroll/MYOPENXPKI_ISSUINGCA.crt

Change the IP address and CA certificate name with your setup information.
Save the file.

Creating a password file for certificate keys

Run the following command:
nano /etc/certs/openxpki_ca-one/pd.pass
Type your password.
Save the file.

Creating a root CA certificate

Note: You can create a self-signed root CA certificate or generate a certificate request, and then get it signed by the root CA.

Run the following commands:

Note: Replace the key length, signature algorithm, and certificate name with the appropriate values.

openssl genrsa -out /etc/certs/openxpki_ca-one/ca-root-1.key -passout file:/etc/certs/openxpki_ca-one/pd.pass 4096
openssl req -new -key /etc/certs/openxpki_ca-one/ca-root-1.key -subj /DC=COM/DC=LEXMARK/DC=DEV/DC=CA-ONE/CN=MYOPENXPKI_ROOTCA -out /etc/certs/openxpki_ca-one/ca-root-1.csr
openssl req -config /etc/certs/openxpki_ca-one/openssl.conf -extensions v3_ca_extensions -x509 -days 3560 -in /etc/certs/openxpki_ca-one/ca-root-1.csr -key /etc/certs/openxpki_ca-one/ca-root-1.key -out /etc/certs/openxpki_ca-one/ca-root-1.crt -sha256

Creating a signer certificate

Note: Replace the key length, signature algorithm, and certificate name with the appropriate values.

Run the following command:
openssl genrsa -out /etc/certs/openxpki_ca-one/ca-signer-1.key -passout file:/etc/certs/openxpki_ca-one/pd.pass 4096
Change the subject in the request with your CA information using openssl req -config /etc/certs/openxpki_ca-one/openssl.conf -reqexts v3_ca_reqexts -new -key /etc/certs/openxpki_ca-one/ca-signer-1.key -subj /DC=COM/DC=LEXMARK/DC=DEV/DC=CA-ONE/CN=MYOPENXPKI_ISSUINGCA -out /etc/certs/openxpki_ca-one/ca-signer-1.csr.
Get the certificate signed by the root CA using openssl x509 -req -extfile /etc/certs/openxpki_ca-one/openssl.conf -extensions v3_issuing_extensions -days 3650 -in /etc/certs/openxpki_ca-one/ca-signer-1.csr -CA /etc/certs/openxpki_ca-one/ca-root-1.crt -CAkey /etc/certs/openxpki_ca-one/ca-root-1.key -CAcreateserial -out /etc/certs/openxpki_ca-one/ca-signer-1.crt -sha256.

Creating a vault certificate

Notes:

The vault certificate is self-signed.
Replace the key length, signature algorithm, and certificate name with the appropriate values.

Run the following command:
openssl genrsa -out /etc/certs/openxpki_ca-one/vault-1.key -passout file:/etc/certs/openxpki_ca-one/pd.pass 4096
Change the subject in the request with your CA information using openssl req -config /etc/certs/openxpki_ca-one/openssl.conf -reqexts v3_datavault_reqexts -new -key /etc/certs/openxpki_ca-one/vault-1.key -subj /DC=COM/DC=LEXMARK/DC=DEV/DC=CA-ONE/DC=STLOPENXPKI_INTERNAL/CN=MYOPENXPKI_DATAVAULT -out /etc/certs/openxpki_ca-one/vault-1.csr.
Run the following command:
openssl req -config /etc/certs/openxpki_ca-one/openssl.conf -extensions v3_datavault_extensions -x509 -days 3560 -in /etc/certs/openxpki_ca-one/vault-1.csr -key /etc/certs/openxpki_ca-one/vault-1.key -out /etc/certs/openxpki_ca-one/vault-1.crt

Creating an SCEP certificate

Note: The SCEP certificate is signed by the signer certificate.

Run the following commands:

Note: Replace the key length, signature algorithm, and certificate name with the appropriate values.

openssl genrsa -out /etc/certs/openxpki_ca-one/scep-1.key -passout file:/etc/certs/openxpki_ca-one/pd.pass 4096
openssl req -config /etc/certs/openxpki_ca-one/openssl.conf -reqexts v3_scep_reqexts -new -key /etc/certs/openxpki_ca-one/scep-1.key -subj /DC=COM/DC=LEXMARK/DC=DEV/DC=CA-ONE/CN=MYOPENXPKI_SCEPCA -out /etc/certs/openxpki_ca-one/scep-1.csr
openssl x509 -req -extfile /etc/certs/openxpki_ca-one/openssl.conf -extensions v3_scep_extensions -days 900 -in /etc/certs/openxpki_ca-one/scep-1.csr -CA /etc/certs/openxpki_ca-one/ca-signer-1.crt -CAkey /etc/certs/openxpki_ca-one/ca-signer-1.key -CAcreateserial -out /etc/certs/openxpki_ca-one/scep-1.crt -sha256

Copying the key file and creating a symlink

Copy the key files to /etc/openxpki/ca/ca-one/.

Note: The key files must be readable by OpenXPKI.

cp /etc/certs/openxpki_ca-one/ca-signer-1.key /etc/openxpki/ca/ca-one/

cp /etc/certs/openxpki_ca-one/vault-1.key /etc/openxpki/ca/ca-one/

cp /etc/certs/openxpki_ca-one/scep-1.key /etc/openxpki/ca/ca-one/

Create the symlink.

Note: Symlinks are aliases used by the default configuration.

ln -s /etc/openxpki/ca/ca-one/ca-signer-1.key /etc/openxpki/ca/ca-one/ca-signer-1.pem

ln -s /etc/openxpki/ca/ca-one/scep-1.key /etc/openxpki/ca/ca-one/scep-1.pem

ln -s /etc/openxpki/ca/ca-one/vault-1.key /etc/openxpki/ca/ca-one/vault-1.pem

Importing certificates

Import the root certificate, signer certificate, vault certificate, and SCEP certificate into the database with the appropriate tokens.

Run the following commands:

openxpkiadm certificate import --file /etc/certs/openxpki_ca-one/ca-root-1.crt
openxpkiadm certificate import --file /etc/certs/openxpki_ca-one/ca-signer-1.crt --realm ca-one --token certsign
openxpkiadm certificate import --file /etc/certs/openxpki_ca-one/scep-1.crt --realm ca-one --token scep
openxpkiadm certificate import --file /etc/certs/openxpki_ca-one/vault-1.crt --realm ca-one --token datasafe

Check whether the import is successful using openxpkiadm alias --realm ca-one.

Sample output

=== functional token ===
scep (scep):
Alias    : scep-1
Identifier: YsBNZ7JYTbx89F_-Z4jn_RPFFWo
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2016-01-30 20:44:40

vault (datasafe):
Alias    : vault-1
Identifier: lZILS1l6Km5aIGS6pA7P7azAJic
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2016-01-30 20:44:40

ca-signer (certsign):
Alias    : ca-signer-1
Identifier: Sw_IY7AdoGUp28F_cFEdhbtI9pE
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2018-01-29 20:44:40

=== root ca ===
current root ca:
Alias     : root-1
Identifier: fVrqJAlpotPaisOAsnxa9cglXCc
NotBefore : 2015-01-30 20:44:39
NotAfter  : 2020-01-30 20:44:39

upcoming root ca:
  not set

Starting OpenXPKI

Run the openxpkictl start command.

Sample output

Starting OpenXPKI...
OpenXPKI Server is running and accepting requests.
DONE.

Do the following to access the OpenXPKI server:
1. From a web browser, type http://ipaddress/openxpki/.
  Note: Instead of ipaddress, you can also use the FQDN of the server.
2. Log in as Operator. The default password is openxpki.
  Note: The Operator login has two preconfigured operator accounts, raop and raop2.
Create one certificate request, and then test it.

Generating CRL information

Note: If your server is reachable using the FQDN, then use the DNS of the server instead of its IP address.

Stop the OpenXPKI service using Openxpkictl stop.

In nano /etc/openxpki/config.d/realm/ca-one/publishing.yaml, update the connectors: cdp section to the following:

class: Connector::Builtin::File::Path
LOCATION: /var/www/openxpki/CertEnroll/
file: "[% ARGS.0 %].crl"
content: "[% pem %]"

In nano /etc/openxpki/config.d/realm/ca-one/profile/default.yaml, update the following:

crl_distribution_points: section

critical: 0
uri:
    - http://FQDN of the server/CertEnroll/[% ISSUER.CN.0 %].crl
    - ldap://localhost/[% ISSUER.DN %]

authority_info_access: section

critical: 0
ca_issuers: http://FQDN of the server/CertEnroll/MYOPENXPKI.crt
ocsp: http://ocsp.openxpki.org/

Change the IP address and CA certificate name according to your CA server.

In nano /etc/openxpki/config.d/realm/ca-one/crl/default.yaml, do the following:

If necessary, update nextupdate and renewal.

Add ca_issuers to the following section:

extensions:
    		authority_info_access:
        			critical: 0
        			# ca_issuers and ocsp can be scalar or list
        			ca_issuers: http://FQDN of the server/CertEnroll/MYOPENXPKI.crt
       			#ocsp: http://ocsp.openxpki.org/

Change the IP address and CA certificate name according to your CA server.

Start the OpenXPKI service using Openxpkictl start.

Configuring CRL accessibility

Stop the Apache service using service apache2 stop.
Create a CertEnroll directory for crl in the /var/www/openxpki/ directory.
Set openxpki as the owner of this directory, and then configure the permissions to let Apache read and execute, and other services to read only.
chown openxpki /var/www/openxpki/CertEnroll
chmod 755 /var/www/openxpki/CertEnroll
Add a reference to the Apache alias.conf file using nano /etc/apache2/mods-enabled/alias.conf.

After the <Directory "/usr/share/apache2/icons"> section, add the following:

        	Alias /CertEnroll/ "/var/www/openxpki/CertEnroll/"
         	<Directory "/var/www/openxpki/CertEnroll">
               Options FollowSymlinks
               AllowOverride None
               Require all granted
         	</Directory>

Add a reference in the apache2.conf file using nano /etc/apache2/apache2.conf.

Add the following in the Apache2 HTTPD server section:

         	<Directory /var/www/openxpki/CertEnroll>
               Options FollowSymlinks
               AllowOverride None
               Allow from all
         	</Directory>

Start the Apache service using service apache2 start.

Enabling the SCEP service

Stop the OpenXPKI service using openxpkictl stop.
Install the openca-tools package using aptitude install openca-tools.
Start the OpenXPKI service using openxpkictl start.

Test the service using any client, such as certnanny with SSCEP.

Note: SSCEP is a command line client for SCEP. You can download SSCEP from https://github.com/certnanny/sscep.

Enabling the Signer on Behalf (enrollment agent) certificate

For automatic certificate requests, we are using the Signer on Behalf certificate feature of OpenXPKI.

Stop the OpenXPKI service using openxpkictl stop.
In nano /etc/openxpki/config.d/realm/ca-one/scep/generic.yaml, from the authorized_signer: section, add a rule for the subject name of the signer certificate.
```
rule1:
        		# Full DN
            		subject: CN=Markvision_.*
```
Notes:
- In this rule, any certificate CN starting with Markvision_ is the Signer on Behalf certificate.
- The subject name is set in MVE for generating the Signer on Behalf certificate.
- Review the space and indention in the script file.
- If the CN is changed in MVE, then add the updated CN in OpenXPKI.
- You can specify only one certificate as Signer on Behalf, and then specify the full CN.
Save the file.
Start the OpenXPKI service using openxpkictl start.

Enabling automatic approval of certificate requests in OpenXPKI CA

Stop the OpenXPKI service using openxpkictl stop.

In nano /etc/openxpki/config.d/realm/ca-one/scep/generic.yaml, update the eligible: section:

Old content

eligible:
			initial:
				value@: connector:scep.generic.connector.initial
       		args: '[% context.cert_subject_parts.CN.0 %]'
       		expect:
       			- Build
       			- New

New content

eligible:
			initial:
				value: 1
				# value@: connector:scep.generic.connector.initial
				# args: '[% context.cert_subject_parts.CN.0 %]'
				# expect:
				#	- Build
				#	- New

Notes:

Review the space and indention in the script file.
To approve certificates manually, comment value: 1, and then uncomment the other lines that are previously commented.

Save the file.
Start the OpenXPKI service using openxpkictl start.

Creating a second realm

In OpenXPKI, you can configure multiple PKI structures in the same system. The following topics show how to create another realm for MVE named ca-two.

Copying and setting the directory

Copy the /etc/openxpki/config.d/realm/ca-one sample directory tree to a new directory (cp -avr /etc/openxpki/config.d/realm/ca-one /etc/openxpki/config.d/realm/ca-two) within the realm directory.

In /etc/openxpki/config.d/system/realms.yaml, update the following section:

Old content

# This is the list of realms in this PKI
# You only need to enable the realms which are visible on the server

ca-one:
    label: Verbose name of this realm
    baseurl: https://pki.example.com/openxpki/

#ca-two:
#    label: Verbose name of this realm
#    baseurl: https://pki.acme.org/openxpki/

New content

# This is the list of realms in this PKI
# You only need to enable the realms which are visible on the server

ca-one:
    label: CA-ONE
    baseurl: https://pki.example.com/openxpki/

ca-two:
    label: CA-TWO
    baseurl: https://pki.example.com/openxpki/

Save the file.

Creating certificates

The following instructions show how to generate the signer certificate, vault certificate, and SCEP certificate. The root CA signs the signer certificate, and then the signer certificate signs the SCEP certificate. The vault certificate is self-signed.

Generate, and then sign the certificates. For more information, see Configuring OpenXPKI CA manually.
Note: Change the certificate common name so that the user can easily distinguish between different certificates for different realms. You may change DC=CA-ONE to DC=CA-TWO. The certificate files are created in the /etc/certs/openxpki_ca-two/ directory.

Copy the key files to /etc/openxpki/ca/ca-two/.

Note: The key files must be readable by OpenXPKI.

cp /etc/certs/openxpki_ca-two/ca-signer-1.key /etc/openxpki/ca/ca-two/

cp /etc/certs/openxpki_ca-two/vault-1.key /etc/openxpki/ca/ca-two/

cp /etc/certs/openxpki_ca-two/scep-1.key /etc/openxpki/ca/ca-two/

Create the symlink. Also, create a symlink for the root CA certificate.

Note: Symlinks are aliases used by the default configuration.

ln -s /etc/openxpki/ca/ca-one/ca-root-1.crt /etc/openxpki/ca/ca-two/ca-root-1.crt

ln -s /etc/openxpki/ca/ca-two/ca-signer-1.key /etc/openxpki/ca/ca-two/ca-signer-1.pem

ln -s /etc/openxpki/ca/ca-two/scep-1.key /etc/openxpki/ca/ca-two/scep-1.pem

ln -s /etc/openxpki/ca/ca-two/vault-1.key /etc/openxpki/ca/ca-two/vault-1.pem

Import the signer certificate, vault certificate, and SCEP certificate into the database with the appropriate tokens for ca-two.

openxpkiadm certificate import --file /etc/certs/openxpki_ca-two/ca-signer-1.crt --realm ca-two –issuer /etc/openxpki/ca/ca-two/ca-one-1.crt --token certsign

openxpkiadm certificate import --file /etc/certs/openxpki_ca-two/scep-1.crt --realm ca-two --token scep

openxpkiadm certificate import --file /etc/certs/openxpki_ca-two/vault-1.crt --realm ca-two --token datasafe

Check whether the import is successful using openxpkiadm alias --realm ca-two.

Sample output

=== functional token ===
scep (scep):
Alias    : scep-1
Identifier: YsBNZ7JYTbx89F_-Z4jn_RPFFWo
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2016-01-30 20:44:40

vault (datasafe):
Alias    : vault-1
Identifier: lZILS1l6Km5aIGS6pA7P7azAJic
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2016-01-30 20:44:40

ca-signer (certsign):
Alias    : ca-signer-1
Identifier: Sw_IY7AdoGUp28F_cFEdhbtI9pE
NotBefore : 2015-01-30 20:44:40
NotAfter  : 2018-01-29 20:44:40

=== root ca ===
current root ca:
Alias     : root-1
Identifier: fVrqJAlpotPaisOAsnxa9cglXCc
NotBefore : 2015-01-30 20:44:39
NotAfter  : 2020-01-30 20:44:39

upcoming root ca:
  not set

In this instance, the root CA information is the same for ca-one and ca-two.

If you changed the certificate key password during certificate creation, then update nano /etc/openxpki/config.d/realm/ca-two/crypto.yaml.
Generate the CRLs for this realm. For more information, see Generating CRL information.
Publish the CRLs for this realm. For more information, see Configuring CRL accessibility.

Restart the OpenXPKI service using openxpkictl restart.

Sample output

Stopping OpenXPKI
Stopping gracefully, 3 (sub)processes remaining...
DONE.
Starting OpenXPKI...
OpenXPKI Server is running and accepting requests.
DONE.

Do the following to access the OpenXPKI server:
1. From a web browser, type http://ipaddress/openxpki/.
2. Log in as Operator. The default password is openxpki.
  Note: The Operator login has two preconfigured operator accounts, raop and raop2.

Configuring SCEP endpoint for multiple realms

The default realm SCEP endpoint is http://<ipaddress>/scep/scep. If you have multiple realms, then configure a unique SCEP endpoint (different configuration file) for each realm. In the following instructions, we use two PKI realms, ca-one and ca-two.

Copy the default configuration file in cp /etc/openxpki/scep/default.conf /etc/openxpki/scep/ca-one.conf.
Note: Name the file as ca-one.conf.
In nano /etc/openxpki/scep/ca-one.conf, change the realm value to realm=ca-one.
Create another configuration file in cp /etc/openxpki/scep/default.conf /etc/openxpki/scep/ca-two.conf.
Note: Name the file as ca-two.conf.
In nano /etc/openxpki/scep/ca-two.conf, change the realm value to realm=ca-two.
Restart the OpenXPKI service using openxpkictl restart.

The SCEP endpoints are the following:

ca-one—http://ipaddress/scep/ca-one
ca-two—http://ipaddress/scep/ca-two

If you want to differentiate between login credentials and default certificate templates for different PKI realms, then you may need advanced configuration.

Enabling multiple active certificates with same subject to be present at a time

By default, in OpenXPKI only one certificate with the same subject name can be active at a time. But when you are enforcing multiple Named Certificates, multiple active certificates with the same subject name must be present at a time.

In /etc/openxpki/config.d/realm/REALM NAME/scep/generic.yaml, from the policy section, change the value of max_active_certs from 1 to 0.
Notes:
- REALM NAME is the name of the realm. For example, ca-one.
- Review the space and indentation in the script file.
Restart the OpenXPKI service using openxpkictl restart.

Setting the default port number for OpenXPKI CA

By default, Apache listens in port number 80. Set the default port number for OpenXPKI CA to avoid conflicts.

In /etc/apache2/ports.conf, add or modify a port. For example, Listen 8080.
In /etc/apache2/sites-enabled/000-default.conf, add or modify the VirtualHost section to map new port. For example, <VirtualHost *:8080>.
Restart the Apache server using systemctl restart apache2.

To check the status, run netstat -tlpn| grep apache. The OpenXPKI SCEP URL is now http://ipaddress:8080/scep/ca-one, and the web URL is http://ip address:8080/openxpki.

Rejecting certificate requests without Challenge Password in OpenXPKI CA

By default, OpenXPKI accepts requests without checking the challenge password. The certificate request is not rejected, and the CA and CA administrator determine whether to approve or reject the request. To avoid potential security concerns, disable this feature so that any certificate requests that contain invalid passwords are rejected immediately. In MVE, Challenge Password is required only when generating the enrollment agent certificate.

In etc/openxpki/config.d/realm/REALM NAME/scep/generic.yaml, from the policy section, change the value of allow_man_authen from 1 to 0.
Notes:
- REALM NAME is the name of the realm. For example, ca-one.
- Review the space and indentation in the script file.
Restart the OpenXPKI service using openxpkictl restart.

Adding client authentication EKU in certificates

In /etc/openxpki/config.d/realm/REALM NAME/profile/I18N_OPENXPKI_PROFILE_TLS_SERVER.yaml, from the extended_key_usage: section, change the value of client_auth: to 1.
Notes:
- REALM NAME is the name of the realm. For example, ca-one.
- Review the space and indentation in the script file.
Restart the OpenXPKI service using openxpkictl restart.

Getting the full certificate subject when requesting through SCEP

By default, OpenXPKI reads only the CN of the subject of the requesting certificate. The rest of the information, such as country, locality, and DC, are hard-coded. For example, if a certificate subject is C=US, ST=KY, L=Lexington, O=Lexmark, OU=ISS, CN=ET0021B7C34AEC.dhcp.dev.lexmark.com, then after signing the certificate through SCEP, the subject is changed to DC=Test Deployment, DC= OpenXPKI, CN=ET0021B7C34AEC.dhcp.dev.lexmark.com.

Note: REALM NAME is the name of the realm. For example, ca-one.

In /etc/openxpki/config.d/realm/REALM NAME/profile/I18N_OPENXPKI_PROFILE_TLS_SERVER.yaml, from the enroll section, change the value of dn to the following:

CN=[% CN.0 %][% IF OU %][% FOREACH entry = OU %],OU=[% entry %][% END %][% END %][% IF O %][% FOREACH entry = O %],O=[% entry %][% END %][% END %][% IF L %],L=[% L.0 %][% END %][% IF ST %],ST=[% ST.0 %][% END %][% IF C %],C=[% C.0 %][% END %][% IF DC %][% FOREACH entry = DC %],DC=[% entry %][% END %][% END %][% IF EMAIL %][% FOREACH entry = EMAIL %],EMAIL=[% entry %][% END %][% END %]

Save the file.
Create a file titled l.yaml in the /etc/openxpki/config.d/realm/REALM NAME/profile/template directory.

Add the following:

id: L
label: L
description: I18N_OPENXPKI_UI_PROFILE_L_DESC
preset: L
type: freetext
width: 60
placeholder: Kolkata

Save the file.
Create a file titled st.yaml in the /etc/openxpki/config.d/realm/REALM NAME/profile/template directory.

Add the following:

id: ST
label: ST
description: I18N_OPENXPKI_UI_PROFILE_ST_DESC
preset: ST
type: freetext
width: 60
placeholder: WB

Save the file.
Note: OpenXPKI must own both files and must be readable, writable, and executable.
Restart the OpenXPKI service using openxpkictl restart.

Revoking certificates and publishing CRL

Access the OpenXPKI server.
1. From a web browser, type http://ipaddress/openxpki/.
2. Log in as Operator. The default password is openxpki.
  Note: The Operator login has two preconfigured operator accounts, raop and raop2.
Click Workflow Search > Search now.
Click a certificate to revoke, and then click the certificate link.
From the Action section, click revocation request.
Type the appropriate values, and then click Continue > Submit request.
On the next page, approve the request. The certificate revocation is waiting for the next CRL publish.
From the PKI Operation section, click Issue a certificate revocation list (CRL).
Click Enforce creation of revocation lists > Continue.
From the PKI Operation section, click Publish CA/CRL.
Click Workflow Search > Search now.
Click the revoked certificate with a certificate_revocation_request_v2 type.
Click Force wake up.

In the new CRL, you can find the serial number and the revocation reason of the revoked certificate.