Do it yourself CA

Recently got questions on testing with certificates. Use self-signed certificates or CA signed certs? And how to easily obtain CA signed certs? It was quite a while ago that I had been playing with certs myself. So time to refresh my mind, do some searching + experimenting, and write a blog entry about it.

CA signed certificates (SSL server and client) are recommended as only the CA cert needs to be imported as a trusted certificate (e.g. in cacerts). First option is to use a free CA like CAcert.

Second option is to setup your own (test) CA. The most obvious option is to use openssl. The command line tool of openssl allows to first create a CA keypair + CA self-signed cert and next sign certificate requests (CSR), thereby creating CA signed certificates.

Alternative tools for a do-it-yourself CA with GUI are:

• EJBCA: runs on top of J2EE app server
• LigthCA: on top of OpenSSL
  
• SimpleAuthority: standalone Java app, includes Windows installer
  

Played around a bit with this SimpleAuthority, and it looks quite OK. One can import certficate signing requests and export signed cert. A very limited version is free, but to manage an unlimited number of certificates, the cost is $50 (personal) to $240 (commercial). The ease-of-use and consistency of the GUI could be improved, but it does do the job.

Notes:

• To generate and manage keystores, thé recommended tools is Portecle.
• Alternative is Keytool IUI: it has extra features such as signing of files, but less user friendly than Portecle.
• All sorts of links about PKI
  

The brower model is broken

I'm not a security specialist, but I find IT security a very interesting topic. As a longtime listener of the Security Now podcast, I listened to another interesting story: "The Broken Browser Model". The talk was inspired on a presentation given at the Black Hat conference.

Main message of the podcast is the insecurity when a mix of HTTP and HTTPS is used. The HTML coming in over an insecure connection can be manipulated by a "man-in-the-middle" (e.g. through ARP spoofing), turning all the https:// URL (and more) into standard insecure http://. The man-in-the-middle initiates the SSL connections and can sniff all information going over the connection. A 24hr test of a (unknown) public hotspot revealed passwords for Yahoo, Gmail, Paypal and more, without any of the users noticing anything.