Changes between Version 2 and Version 3 of Encryption/SSL

Timestamp:

08/09/16 13:36:02 (6 years ago)

Author:

Antoine Martin

Comment:

add ca example

Encryption/SSL

@@ -49 +49 @@
 See also: [https://lwn.net/Articles/666353/ Fallout from the Python certificate verification change].
 
-Since the server certificate will not be signed by any recognized certificate authorities, you will need to send the ca_cert file to the client via some other means... This will no be handled by xpra, it simply cannot be. (same as the AES key, at which point... you might as well use AES)
+Since the server certificate will not be signed by any recognized certificate authorities, you will need to send the verification data to the client via some other means... This will no be handled by xpra, it simply cannot be. (same as the AES key, at which point... you might as well use AES)
 
-See [https://carlo-hamalainen.net/blog/2013/1/24/python-ssl-socket-echo-test-with-self-signed-certificate Python SSL socket echo test with self-signed certificate] for generating this x509 keystore. (''server.crt'' in this example).
+
+----
+
+{{{
+# generate your CA key and certificate:
+openssl genrsa -out ca.key 4096
+# (provide the 'Common Name', ie: 'Example Internal CA')
+openssl req -new -x509 -days 365 -key ca.key -out ca.crt
+# generate your server key:
+openssl genrsa -out server.key 4096
+# make a signing request from the server key:
+# (you must provide the 'Common Name' here, ie: 'localhost' or 'test.internal')
+openssl req -new -key server.key -out server.csr
+# sign it with your CA key:
+openssl x509 -req -days 365 \
+    -in server.csr -out server.crt \
+    -CA ca.crt -CAkey ca.key \
+    -CAserial ./caserial -CAcreateserial
+# verify it (it should print "OK"):
+openssl verify -CAfile ca.crt ./server.crt
 }}}
+You can now start your xpra server using this key:
+{{{
+xpra start --start=xterm \
+    --bind-tcp=0.0.0.0:10000 --ssl=on --ssl-cert=`pwd`/server.crt --ssl-key=`pwd`/server.key
+}}}
+Use openssl to verify that this xpra server uses SSL and that the certificate can be verified using the "ca.crt" authority file: (it should print {{{Verify return code: 0 (ok)}}}):
+{{{
+openssl s_client -connect 127.0.0.1:10000  -CAfile ca.crt < /dev/null
+}}}
+Connect the xpra client:
+{{{
+xpra attach ssl:localhost:10000 --ssl-ca-cert=./ca.crt
+}}}
+}}}