2

(This is a question about using XCA, not openssl, and this is my motivation)

I created CA, Server, and Client certificates:

  • Within XCA, do I need to create these certificates differently?
  • Does each certificate have an exact required list of Key Usage & Extended Key Usage (e.g. all the necessary with no extra)?
    • The client certificate has Key Usage Certificate Sign and it doesn't look good.

Steps performed:

  1. I installed XCA from the Microsoft Store:
  2. I read the Creating certificates with XCA from Fortinet and created:
    Screenshot1

    1. CA: RDP_CA

    2. IPSec Server: WS_RDP
      The workstation I want to access by RDP
      Screenshot2

    3. IPSec Client: PAW_RDP
      The only privileged client that should not be denied
      Screenshot2

Amit
  • 362

1 Answers1

2

I found the way:

  1. Install XCA from Windows Store:
    (as of 24/11/2023, v2.5.0 uses OpenSSL v3.1.2.1 from August 2023)
    Screenshot1

  2. Prepare a clean USB Stick for XCA database → Run XCA

  3. Create a new database on the USB Stick: Home.xcd
    The database is password protected, so it is necessary to choose one for future use
    Screenshot2

  4. Tab: Templates
    XCA has four default templates for any arbitrary, non-specific use case

    1. [default] Empty template
    2. [default] CA
    3. [default] TLS_Client
    4. [default] TLS_Server

  5. New tepmlate & Change template → Edit XCA template dialog
    For IPSec certificates, I generated three new templates

    1. IPSec_CA_Template (inherited from 4.2)
    2. IPSec_Client_Template (inherited from 4.3)
    3. IPSec_Server_Template (inherited from 4.4)
      Screenshot3

  6. Tab: Key Usage
    Select Key Usage (KU), Extended KU (EKU), and critical (optional)
    enter image description here

    1. CA:

      keyUsage=critical,digitalSignature, keyCertSign, cRLSign

    2. Client:

      keyUsage=critical,digitalSignature, keyEncipherment
extendedKeyUsage=critical,clientAuth

    3. Server:

      keyUsage=critical,digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage=critical,serverAuth

  7. Tab: Subject
    Screenshot5

  8. Tab: Netscape
    Unselected all and deleted the comment


Once the customized templates are ready - This is the start point, for any new certificate


Create New Certificate
I adhered to the Creating certificates with XCA manual of Fortinet for the creation of the certificates but with the customized templates from section 5. Since the customized templates contain all the data, including Subject and Extensions, it is necessary to click Apply All instead of Apply Extensions as written in the manual. Example for Server Certificate:

enter image description here


[For Client / Server certificate. Not for CA]
(2nd thing after tab Source) The only thing that is not in the template is the X509v3 Subject Alternative Name. It should be entered specifically with the hostname and the domain of the entity for whom the certificate is issued.
Since it is a DHCP-enabled environment, fixed IPs are not assumed, and instead, a hostname.domain syntax is used. Refer to the appendix for information about configuring local-domain.

enter image description here



Resultant V3 Profiles:
Here are the X509v3 extensions (in compare with this reference)

  • CA: (The reference has also: authorityKeyIdentifier)

    basicConstraints=critical,CA:TRUE
keyUsage=critical,digitalSignature, keyCertSign, cRLSign
subjectKeyIdentifier=hash

  • Client: (The reference has also: authorityKeyIdentifier, nonrepudiation (KU))

    subjectAltName=critical,DNS:DESKTOP-KGXWQ2R.home
extendedKeyUsage=critical,clientAuth
keyUsage=critical,digitalSignature, keyEncipherment
subjectKeyIdentifier=hash
basicConstraints=critical,CA:FALSE

  • Server: (The reference has also: authorityKeyIdentifier, nonRepudiation(KU))

    subjectAltName=critical,DNS:DESKTOP-24JFXST.home
extendedKeyUsage=critical,serverAuth
keyUsage=critical,digitalSignature, keyEncipherment, keyAgreement
subjectKeyIdentifier=hash
basicConstraints=critical,CA:FALSE
  • Based on the comments below, authorityKeyIdentifier "is usually not mandatory" and nonRepudiation "is not used for any network protocol".


Appendix: Local Domain

For the local domain home I had to configure my router (that accepts on that field only a-z and - chars):

enter image description here


To verify whether the computer is within the home local domain, open cmd.exe and enter:

ipconfig /all

As desired: enter image description here

Amit
  • 362