Package: certidude
IntroductionCertidude is a novel X.509 Certificate Authority management tool
with privilege isolation mechanism and Kerberos authentication aiming to
eventually support PKCS#11 and in far future WebCrypto.Certidude is mainly designed for VPN gateway operators to make
desktop/laptop VPN setup as easy as possible.
User certificate management eg. for HTTPS is also made reasonably simple.
For a full-blown CA you might want to take a look atEJBCAorOpenCA.FeaturesCommon:Standard request, sign, revoke workflow via web interface.Kerberos and basic auth based web interface authentication.PAM and Active Directory compliant authentication backends: Kerberos single sign-on, LDAP simple bind.POSIX groups and Active Directory (LDAP) group membership based authorization.Command-line interface, check outcertidude list.Privilege isolation, separate signer process is spawned per private key isolating
private key use from the the web interface.Certificate serial numbers are intentionally randomized to avoid leaking information about business practices.Server-side events support vianchan.E-mail notifications about pending, signed and revoked certificates.Virtual private networking:OpenVPN integration, check outcertidude setup openvpn serverandcertidude setup openvpn client.strongSwan integration, check outcertidude setup strongswan serverandcertidude setup strongswan client.NetworkManager integration, check outcertidude setup openvpn networkmanagerandcertidude setup strongswan networkmanager.HTTPS:P12 bundle generation for web browsers, seems to work well with AndroidHTTPS server setup with client verification, check outcertidude setup nginxTODOOCSPsupport, needs a bit hacking since OpenSSL wrappers are not exposing the functionality.SECPsupport, a client implementation availablehere. Not sure if we can implement server-side events within current standard.Deep mailbox integration, eg fetch CSR-s from mailbox via IMAP.WebCrypto support, meanwhile check outhwcrypto.js.Certificate push/pull, making it possible to sign offline.PKCS#11 hardware token support for signatures at command-line.Ability to send.ovpnbundle URL tokens via e-mail, for simplified VPN adoption.Cronjob for deleting expired certificatesSigner process logging.InstallTo install Certidude:apt-getinstall-ypythonpython-pippython-devcython\python-cffipython-configparser\python-pysqlite2python-mysql.connectorpython-ldap\build-essentiallibffi-devlibssl-devlibkrb5-dev\ldap-utilskrb5-user\libsasl2-modules-gssapi-mitpipinstallcertidudeSetting up authorityFirst make sure the machine used for certificate authority has fully qualified
domain name set up properly.
You can check it with:hostname-fThe command should returnca.example.com.If necessary tweak machine’s fully qualified hostname in/etc/hosts:127.0.0.1 localhost
127.0.1.1 ca.example.com caThen proceed to installnchananduwsgi:wgethttps://nchan.slact.net/download/nginx-common.debhttps://nchan.slact.net/download/nginx-extras.debdpkg-inginx-common.debnginx-extras.debapt-getinstallnginxuwsgiuwsgi-plugin-pythonCertidude can set up certificate authority relatively easily.
Following will set up certificate authority in/var/lib/certidude/hostname.domain.tld,
configure uWSGI in/etc/uwsgi/apps-available/certidude.ini,
nginx in/etc/nginx/sites-available/certidude.conf,
cronjobs in/etc/cron.hourly/certidudeand much more:certidudesetupauthorityTweak the configuration in/etc/certidude/server.confuntil you meet your requirements and
spawn the signer process:certidudesignerspawnFinally restart services:servicenginxrestartserviceuwsgirestartCertificate managementUse following command to request a certificate on a machine:certidude setup client ca.example.comUse following to list signing requests, certificates and revoked certificates on server:certidude listUse web interface or following to sign a certificate on server:certidude sign client-hostname-or-common-nameSetting up Active Directory authenticationFollowing assumes you have already set up Kerberos infrastructure and
Certidude is simply one of the servers making use of that infrastructure.Install dependencies:apt-getinstallsamba-common-binkrb5-userldap-utilsReset Samba client configuration in/etc/samba/smb.conf:[global]security=adsnetbios name=CAworkgroup=EXAMPLErealm=EXAMPLE.COMkerberos method=system keytabReset Kerberos configuration in/etc/krb5.conf:[libdefaults]default_realm=EXAMPLE.COMdns_lookup_realm=truedns_lookup_kdc=trueInitialize Kerberos credentials:kinitadministratorJoin the machine to domain:netadsjoin-kSet up Kerberos keytab for the web service:KRB5_KTNAME=FILE:/etc/certidude/server.keytabnetadskeytabaddHTTP-kchownroot:certidude/etc/certidude/server.keytabchmod640/etc/certidude/server.keytabReconfigure /etc/certidude/server.conf:[authentication]backends=kerberos[authorization]backend=ldapldap gssapi credential cache=/run/certidude/krb5ccldap user filter=(&(objectclass=user)(objectcategory=person)(samaccountname=%s))ldap admin filter=(&(memberOf=cn=Domain Admins,cn=Users,dc=example,dc=com)(samaccountname=%s))User filter here specified which users can log in to Certidude web interface
at all eg. for generating user certificates for HTTPS.
Admin filter specifies which users are allowed to sign and revoke certificates.
Adjust admin filter according to your setup.
Also make sure there is cron.hourly job for creating GSSAPI credential cache -
that’s necessary for querying LDAP using Certidude machine’s credentials.Automating certificate setupUbuntu 14.04 based desktops come with NetworkManager installed.
Create/etc/NetworkManager/dispatcher.d/certidudewith following content:#!/bin/sh -e# Set up certificates for IPSec connectioncase"$2"inup)LANG=C.UTF-8/usr/local/bin/certiduderequestspawn-k;;esacFinally make it executable:chmod+x/etc/NetworkManager/dispatcher.d/certidudeWhenever a wired or wireless connection is brought up,
the dispatcher invokescertidudein order to generate RSA keys,
submit CSR, fetch signed certificate,
create NetworkManager configuration for the VPN connection.DevelopmentClone the repository:gitclonehttps://github.com/laurivosandi/certidudecdcertidudeInstall dependencies as shown above and additionally:pipinstall-rrequirements.txtTo generate templates:apt-getinstallnpmnodejssudoln-snodejs/usr/bin/node# Fix 'env node' on Ubuntu 14.04npminstall-gnunjucksnunjucks-precompile--include"\\.html$"--include"\\.svg$"certidude/static/>certidude/static/js/templates.jsTo run from source tree:PYTHONPATH=.KRB5CCNAME=/run/certidude/krb5ccKRB5_KTNAME=/etc/certidude/server.keytabLANG=C.UTF-8pythonmisc/certidudeTo install the package from the source:pythonsetup.pyinstall--single-version-externally-managed--root/