Setting-up a Simple CA Using the strongSwan PKI Tool » History » Version 8

Version 7 (Jean-Michel Pouré, 24.12.2009 09:17) → Version 8/39 (Andreas Steffen, 24.12.2009 09:22)

h1. Setting-up a simple CA using strongSwan PKI tool

This How-To sets up a Certificate Authority using strongSwan [[IpsecPKI|PKI]] tool, keeping it as simple as possible.

h2. CA certificate

First, [[IpsecPKIGen|generate]] a private key, the default generates a 2048 bit RSA key:
ipsec pki --gen > caKey.der
For a real-world setup, make sure to keep this key private.

Now [[IpsecPKISelf|self-sign]] a CA certificate using the generated key:
ipsec pki --self --in caKey.der --dn "C=CH, O=strongSwan, CN=strongSwan CA" --ca > caCert.der
Adjust the distinguished name to your needs, it will be included in all issued certificates.

That's it, your CA is ready to issue certificates.

h2. End entity certificates

For each peer, generate a private key and [[IpsecPKIIssue|issue]] a certificate using your new CA:

ipsec pki --gen > peerKey.der

ipsec pki --pub --in peerKey.der | ipsec pki --issue --cacert caCert.der --cakey caKey.der
--dn "C=CH, O=strongSwan, CN=peer" > peerCert.der

The second command [[IpsecPKIPub|extracts the public key]] and issues a certificate using your CA. Distribute private key and certificate to your peer.

h2. Install certificates

h2. Install certificates

Certificates and keys are stored in /etc/ipsec.d subdirectories.
Here we take
the */etc/ipsec.d/* subdirectory tree: example of Moon (gateway) and Carol (peer).

On moon:
* */etc/ipsec.d/private/peerKey.der* /etc/ipsec.d/[fix-me]/moonKey.der holds the private public key of the peer. your CA.
* */etc/ipsec.d/certs/peerKey.der* /etc/ipsec.d/[fix-me/moonKey.der holds the end entitity certificate private key of your CA.

On carol:
* /etc/ipsec.d/[fix-me]/carolKey.der holds
the peer. public key for your certificate.
* */etc/ipsec.d/cacerts/caCert.der* /etc/ipsec.d/[fix-me/carolKey.der holds the CA certificate which issued and signed all peer certificates.
private key for your certificate.