CA Website

As we need a place to inform our users about the CA, distribute our certificates and publish revocation information, we create a website.

IP Addresses

In this example we use 192.0.2.28 and 2001:db8:face::28 as IP addresses for the website.

To add the IPv4 address:

$ sudo ip addr add 192.0.2.28/24 dev eth0

To add the IPv6 address:

$ sudo ip addr add 2001:db8:26:845::28/64 dev eth0

Edit /etc/network/interfaces:

...

# ca.example.net
iface eth0 inet static
    address 192.0.2.28/24
iface eth0 inet6 static
    address 2001:db8::28/64

Nginx Configuration

For now a simple static website with some information and relevant files to download will do.

The complete file is available for download.

 1#
 2# Certificate Authority Website
 3# ca.example.net
 4
 5# Unsecured HTTP Site
 6server {
 7
 8    # IPv4 private address (Port-forwarded from NAT firewall/router)
 9    listen                  192.0.2.10:80;
10
11    # IPv6 global address
12    listen                  [2001:db8::28]:80;
13
14    server_name             ca.example.net;
15
16    # Server Default Settings
17    include                 /etc/nginx/server-defaults/*.conf;
18
19    # Public Documents Root
20    root                    /var/www/ca.example.net/public_html;
21}
22
23# Secured HTTPS Site
24server {
25
26    # IPv4 private address (Port-forwarded from NAT firewall/router)
27    listen                  192.0.2.10:443 ssl spdy;
28
29    # IPv6 global address
30    listen                  [2001:db8::28]:443 ssl spdy;
31
32    server_name             ca.example.net;
33
34    # TLS settings
35    include                 /etc/nginx/tls.conf;
36    include                 /etc/nginx/ocsp-stapling.conf;
37    ssl_certificate         /etc/ssl/certs/example.net.chained.cert.pem;
38    ssl_certificate_key     /etc/ssl/private/example.net.key.pem;
39    ssl_trusted_certificate /etc/ssl/certs/CAcert_Class_3_Root.OCSP-chain.pem;
40    add_header              'Public-Key-Pins' 
41        'pin-sha256="SXdoaC3aoo/NgckESACRQgOkv4At2gXRyVM7puNt28w=";
42         pin-sha256="YAPsGXfNvFh435aZmtCIBSC7kVdE7p7pjt2k1llJ78Y="; 
43         max-age=15768000';
44
45    # Server Default Settings
46    include                 /etc/nginx/server-defaults/*.conf;
47
48    # Public Documents Root
49    root                    /var/www/ca.example.net/public_html;
50}

Information Page

The CA’s website should contain the following information in human readable form:

  • General information about the CA.

  • Contact information.

  • Certification policies.

  • How to verify the root certificate of this CA.

  • How to set this CA’s root certificate as trusted in various clients.

  • How to request a signed certificates from by this CA.

  • How to install signed certificates in various clients and servers.

  • How to request revocation in case of loss or compromise of private keys.

CA Files

Install the CA certificates and CRLs on the server for users and clients to download, so that clients can download them while verifying certificates:

  • Root CA Certificate /certs/root-ca.crt

  • Root CA Revocation List /crl/root-ca.crl

  • Intermediate CA Certificate /certs/intermed-ca.crt

  • Intermediate CA Revocation List /crl/intermed-ca.crl