#!/usr/bin/perl
# -*- mode: cperl; coding: utf-8; -*-

use strict;
use warnings;
use utf8;

use lib "/h/hamren/src/post/lib", "."; my $rval = do "common.pm" || die "$0: common.pm failed ($!) [$@]";  #--- Single-line common initializer

#--- End of header

my ($preamble, $body) = get_tex("creating-a-web-site-certificate.tex");

(my $link_table = <<'END') =~ s/\s+/ /;
<table width='100%%', style='margin:0px;border:0'>
    <tr>
        <td style='text-align:left; padding:0; border:0'>
            %s
        </td>
        <td style='text-align:right; padding:0; border:0'>
            %s
        </td>
    </tr>
</table>
END

post(
     header(),
     p(q{As discussed in the previous article in this series, the disadvantage with our own certificates  is that web browsers will complain loudly about these possibly unsafe certificates. In this article we will improve on this by becoming our own Certificate Authority. This involves generating a special "root" certificate, and giving users the option of importing that certificate into the list of trusted Certificate Authorities.}),

     img_float_right(tikz_to_png_processor("fig-3", $preamble, '\catrue \plaintexttrue \p'),
                     "Using a password-protected private key",
                     sprintf($link_table,
                             href_pdf_image   ("fig-3.pdf"),
                             href_latex_source("fig-3.ltx"))),

     p("Surprisingly, generating the files we need to become an (unofficial) Certificate Authority is easier than generating a standard certificate. It only involves only two steps:"),
     ul(
 	"Create a password-protected encryption key.",
 	"Create the certificate.",
       ),

     p("The command lines below have been split over several lines for readability."),

      source_codeq(<<'EOF'),
$ openssl genrsa -passout env:CAPASS
                 -des3
                 -out authority.key 2048
EOF
     p("This invocation of the genrsa subcommand generates a 2048-bit private encryption key using the RSA algorithm. The encryption key is then encrypted with the DES3 algoritm, using the password contained in the CAPASS environment variable. Since this is the key that all security will rely on, we do not create an unprotected version. Since it is only used for signing, having to enter it manually is not much of a problem."),

      source_codeq(<<'EOF'),
$ openssl req  -new
               -x509
               -days 36500
               -passin  env:CAPASS
               -subj '/C=SE/ST=root_ca_cert/L=Lund/O=Svensk Datorutveckling'
               -key authority.key
               -out authority.cert
EOF
     img_float_right(tikz_to_png_processor("fig-4", $preamble, '\catrue \plaintextfalse \p'),
                     "Using an unprotected private key",
                     sprintf($link_table,
                             href_pdf_image   ("fig-4.pdf"),
                             href_latex_source("fig-4.ltx"))),

     p("Previously we used this command to create and sign our new certificate:"),

      source_codeq(<<'EOF'),
$ openssl x509 -req
               -days    36500
               -in      certificate-signing-request.csr
               -out     certificate.cert
               -signkey rsa-private-key-without-password.key
EOF
     p("To sign instead with our root CA, we use:"),

      source_codeq(<<'EOF'),
$ openssl x509 -req
               -days   36500
               -in     certificate-signing-request.csr
               -out    certificate.cert
               -passin env:CAPASS
               -CA     authority.cert
               -CAkey  authority.key
               -CAcreateserial
EOF
     p(q{Gone is the "-signkey" option. Instead we specify the key and the certificate of our root CA. The -CAcreateserial option creates a serial-number file. It is used to give each signed certificate a unique serial number. The file name is derived from the name of the root CA certificate file, but with a .srl suffix. In this example, authority.cert becomes authority.srl. This option should only be used once. Next time, run the command without it:}),

      source_codeq(<<'EOF'),
$ openssl x509 -req
               -days   36500
               -in     certificate-signing-request.csr
               -out    certificate.cert
               -passin env:CAPASS
               -CA     authority.cert
               -CAkey  authority.key
EOF

     p(q{To actually take advantage of the extra work, users must import "authority.cert" into their browsers, in some browser-dependent way. Once that is done, the browser will implicitly trust any certificate signed by our Certification Authority (root CA).}),

    footer()

)