OpenSSL: Ubuntu - Revision history

Onnowpurbo: /* Configuring Apache for SSL Support */

2017-06-15T00:13:40Z

Configuring Apache for SSL Support

← Older revision		Revision as of 00:13, 15 June 2017
Line 516:		Line 516:
	4. Anda telah berhasil mengimport your certificate anda ke system CA certificates database.		4. Anda telah berhasil mengimport your certificate anda ke system CA certificates database.

	==~~Configuring~~ Apache ~~for~~ SSL Support==		==Konfigurasi Apache untuk SSL Support==

	~~To configure Apache2 for HTTPS and generate a certificate, follow the instructions in Server Guide - HTTPD and Server Guide - Certificates.~~		Silahkan baca2

			* [[OpenSSL: set SSL untuk https di Ubuntu]]

	==Resources==		==Resources==

Onnowpurbo: /* Using PKCS#12 Certificates in Client Applications */

2017-06-11T02:02:20Z

Using PKCS#12 Certificates in Client Applications

← Older revision		Revision as of 02:02, 11 June 2017
Line 417:		Line 417:
	==Using PKCS#12 Certificates in Client Applications==		==Using PKCS#12 Certificates in Client Applications==

	~~This section of the guide explains using~~ PKCS#12 ~~certificates for~~ SSL ~~connections from the client perspective~~, ~~and demonstrates the process of importing certificates into the Firefox~~ Web Browser ~~applications~~, ~~and a couple of the more popular~~ E-Mail ~~clients~~.		Bagian panduan ini menjelaskan penggunaan sertifikat PKCS # 12 untuk koneksi SSL dari perspektif klien, dan menunjukkan proses mengimpor sertifikat ke aplikasi Web Browser Firefox, dan beberapa klien E-Mail yang lebih populer.

	~~Importation of a~~ root certificate ~~into such applications enables a trusted~~ SSL~~-encrypted connection to the~~ server ~~from whence the certificate came~~, ~~free of nagging messages about the certificate being self-signed~~, ~~and so on~~.		Pengimporan root certificate ke aplikasi memungkinkan koneksi terenkripsi SSL yang terpercaya ke server darimana sertifikat itu datang, bebas dari pesan yang mengganggu tentang sertifikat yang ditandatangani sendiri, dan seterusnya.

	===Importing a Certificate into Mozilla Firefox===		===Importing a Certificate into Mozilla Firefox===

	~~Importation of a~~ PKCS#12 ~~certificate into the~~ Mozilla Firefox Web Browser ~~application is very simple:~~		Import certificate PKCS#12 ke Mozilla Firefox Web Browser sangat sederhana

	* From within Firefox, click Edit > Preferences		* From within Firefox, click Edit > Preferences
Line 437:		Line 437:
	A message will appear advising that Firefox has "Successfully restored your security certificate(s) and private key(s)"		A message will appear advising that Firefox has "Successfully restored your security certificate(s) and private key(s)"

	Click OK		Click OK
	You have successfully imported the server's client PKCS#12 certificate into Firefox		You have successfully imported the server's client PKCS#12 certificate into Firefox

	===Importing a Certificate into Evolution===		===Importing a Certificate into Evolution===

	~~Importation of a~~ PKCS#12 ~~certificate into the~~ Evolution E-Mail client ~~couldn't be simpler:~~		Import certificate PKCS#12 ke Evolution E-Mail client sangat sederhana

	* From within Evolution, click Edit > Preferences		* From within Evolution, click Edit > Preferences
Line 456:		Line 456:
	You should see the certificate, and its details appear in the Your Certificates section of the Evolution Settings window		You should see the certificate, and its details appear in the Your Certificates section of the Evolution Settings window

	Click the Close button		Click the Close button
	You have successfully imported the server's client PKCS#12 certificate into Evolution		You have successfully imported the server's client PKCS#12 certificate into Evolution

	===Importing a Certificate into Mozilla Thunderbird===		===Importing a Certificate into Mozilla Thunderbird===

	~~Importation of a~~ PKCS#12 ~~certificate into the~~ Mozilla Thunderbird E-Mail client ~~application is very simple~~:		Import certificate PKCS#12 ke Mozilla Thunderbird E-Mail client sangat sederhana:

	* From within Thunderbird, click Edit > Preferences		* From within Thunderbird, click Edit > Preferences
Line 476:		Line 476:
	A message will appear advising that Thunderbird has "Successfully restored your security certificate(s) and private key(s)"		A message will appear advising that Thunderbird has "Successfully restored your security certificate(s) and private key(s)"

	Click OK		Click OK
	You have successfully imported the server's client PKCS#12 certificate into Thunderbird		You have successfully imported the server's client PKCS#12 certificate into Thunderbird

	~~Importing a~~ Certificate ~~into the~~ System-Wide Certificate Authority Database		===Import Certificate ke System-Wide Certificate Authority Database===

	~~You can import a~~ CA ~~Certificate into the system-wide~~ database ~~of trusted certificate authorities~~. ~~Applications that use this~~ database ~~will automatically trust any certificates stored here~~.		Anda dapat mengimpor Sertifikat CA ke dalam database seluruh sistem otoritas sertifikat yang terpercaya. Aplikasi yang menggunakan database ini secara otomatis akan mempercayai sertifikat yang tersimpan di sini.

	1. Copy ~~your~~ certificate ~~to the~~ system certificate directory. ~~At a terminal prompt~~, ~~type:~~		1. Copy certificate anda ke system certificate directory. Di CLI, ketik,

	$ sudo cp mycert.pem /usr/share/ca-certificates/mycert.crt		$ sudo cp mycert.pem /usr/share/ca-certificates/mycert.crt

	2. Edit ~~the~~ ca-certificates ~~configuration file~~ /etc/ca-certificates.conf. ~~Add the name of the~~ file ~~you copied to~~ /usr/share/ca-certificates ~~to the top of the list just after the final "~~#~~". For example:~~		2. Edit konfigurasi ca-certificates /etc/ca-certificates.conf. Tambahkan nama file yang anda copy ke /usr/share/ca-certificates ke daftar paling atas, sesudah tanda '#' terakkhir, contoh,

	# This file lists certificates that you wish to use or to ignore to be		# This file lists certificates that you wish to use or to ignore to be
Line 506:		Line 506:
	[... many additional certificates omitted ...]		[... many additional certificates omitted ...]

	~~Instead of manually editing this~~ file, ~~you can run~~		Dari pada secara manual mengedit file tersebut, anda dapat menjalankan,

	sudo dpkg-reconfigure ca-certificates		sudo dpkg-reconfigure ca-certificates

	3. Update ~~the~~ CA certificates ~~database by typing:~~		3. Update database CA certificates dengan cara mengetik,

	$ sudo update-ca-certificates		$ sudo update-ca-certificates

	4. ~~You have successfully imported~~ your certificate ~~into the~~ system CA certificates database.		4. Anda telah berhasil mengimport your certificate anda ke system CA certificates database.

	==Configuring Apache for SSL Support==		==Configuring Apache for SSL Support==

Onnowpurbo: /* Generating Certificate for Signing by Recognized CA */

2017-06-11T01:23:34Z

Generating Certificate for Signing by Recognized CA

← Older revision		Revision as of 01:23, 11 June 2017
Line 395:		Line 395:
	==Generating Certificate for Signing by Recognized CA==		==Generating Certificate for Signing by Recognized CA==

	~~In order to run a production~~ server ~~which will engage in commercial activity~~, ~~such as~~ "e-commerce", ~~it is required to generate a certificate~~, ~~and have it signed by a recognized Certificate Authority~~ (CA) ~~such as~~ VeriSign. ~~The process for generating a certificate request~~, ~~and obtaining a certificate signed by a recognized~~ CA ~~can be difficult~~. ~~You must complete all requisite~~ "~~paperwork~~" ~~prior to creating a certificate request~~, ~~and ensure all required information is accurate~~.		Untuk menjalankan server produksi yang akan terlibat dalam aktivitas komersial, seperti "e-commerce", diperlukan sertifikat, dan ditandatangani oleh Otoritas Sertifikat (CA) yang diakui seperti VeriSign. Proses untuk menghasilkan permintaan sertifikat, dan mendapatkan sertifikat yang ditandatangani oleh CA yang dikenali bisa menjadi sulit. Anda harus menyelesaikan semua dokumen "yang diperlukan" sebelum membuat permintaan sertifikat, dan memastikan semua informasi yang dibutuhkan akurat.

	~~Assuming you do not wish a passphrase-encrypted key~~, ~~enter the following command to generate the private key~~, ~~and certificate request~~:		Dengan asumsi anda tidak menginginkan kunci yang di enkripsi dengan password, masukkan perintah berikut untuk membuat kunci pribadi, dan permintaan sertifikat:

	openssl req -new -newkey rsa:1024 -nodes -keyout mykey.pem -out myreq.pem		openssl req -new -newkey rsa:1024 -nodes -keyout mykey.pem -out myreq.pem

	~~If you already have a key you wish to use~~, ~~then use the following command instead~~:		Jika anda sudah memiliki kunci yang ingin anda gunakan, gunakan perintah berikut ini:

	openssl req -new -key mykey.pem -out myreq.pem		openssl req -new -key mykey.pem -out myreq.pem

	~~You may wish to verify the signature~~, ~~and information contained in the certificate request~~. ~~Verify the signature with this command~~:		Anda mungkin ingin memverifikasi tanda tangan, dan informasi yang terdapat dalam permintaan sertifikat. Verifikasi tanda tangan dengan perintah ini:

	openssl req -in myreq.pem -noout -verify -key mykey.pem		openssl req -in myreq.pem -noout -verify -key mykey.pem

	~~and verify the information with this command~~:		Dan verifikasi informasi dengan perintah ini:

	openssl req -in myreq.pem -noout -text		openssl req -in myreq.pem -noout -text

	~~The next steps typically involve pasting the content of the certificate request~~ file ~~into the~~ CA~~'s signup form~~, ~~and awaiting the certificate~~. ~~Also~~, ~~you should safeguard the key~~ file, ~~as it will be required to use the certificate you receive from the~~ CA.		Langkah selanjutnya biasanya melibatkan menyisipkan konten file permintaan sertifikat ke dalam formulir pendaftaran CA, dan menunggu sertifikat. Selain itu, anda harus melindungi file kunci, karena akan diminta untuk menggunakan sertifikat yang anda terima dari CA.

	==Using PKCS#12 Certificates in Client Applications==		==Using PKCS#12 Certificates in Client Applications==

Onnowpurbo: /* Configuring Apache for SSL Support */

2017-06-11T01:20:26Z

Configuring Apache for SSL Support

@@ Line 520: / Line 520: @@
 To configure Apache2 for HTTPS and generate a certificate, follow the instructions in Server Guide - HTTPD and Server Guide - Certificates.
-Resources
+==Resources==
 ==Referensi==
 * https://help.ubuntu.com/community/OpenSSL

Onnowpurbo: /* Importing a Certificate into Mozilla Thunderbird */

2017-06-11T01:17:21Z

Importing a Certificate into Mozilla Thunderbird

← Older revision		Revision as of 01:17, 11 June 2017
Line 459:		Line 459:
	You have successfully imported the server's client PKCS#12 certificate into Evolution		You have successfully imported the server's client PKCS#12 certificate into Evolution

	==Importing a Certificate into Mozilla Thunderbird==		===Importing a Certificate into Mozilla Thunderbird===

	Importation of a PKCS#12 certificate into the Mozilla Thunderbird E-Mail client application is very simple:		Importation of a PKCS#12 certificate into the Mozilla Thunderbird E-Mail client application is very simple:

Onnowpurbo: /* Importing a Certificate into Evolution */

2017-06-11T01:17:05Z

Importing a Certificate into Evolution

← Older revision		Revision as of 01:17, 11 June 2017
Line 440:		Line 440:
	You have successfully imported the server's client PKCS#12 certificate into Firefox		You have successfully imported the server's client PKCS#12 certificate into Firefox

	==Importing a Certificate into Evolution==		===Importing a Certificate into Evolution===

	Importation of a PKCS#12 certificate into the Evolution E-Mail client couldn't be simpler:		Importation of a PKCS#12 certificate into the Evolution E-Mail client couldn't be simpler:
Line 457:		Line 457:

	Click the Close button		Click the Close button
	You have successfully imported the server's client PKCS#12 certificate into Evolution		You have successfully imported the server's client PKCS#12 certificate into Evolution

	==Importing a Certificate into Mozilla Thunderbird==		==Importing a Certificate into Mozilla Thunderbird==

Onnowpurbo: /* Using PKCS#12 Certificates in Client Applications */

2017-06-11T01:16:56Z

Using PKCS#12 Certificates in Client Applications

← Older revision		Revision as of 01:16, 11 June 2017
Line 421:		Line 421:
	Importation of a root certificate into such applications enables a trusted SSL-encrypted connection to the server from whence the certificate came, free of nagging messages about the certificate being self-signed, and so on.		Importation of a root certificate into such applications enables a trusted SSL-encrypted connection to the server from whence the certificate came, free of nagging messages about the certificate being self-signed, and so on.

	Importing a Certificate into Mozilla Firefox		===Importing a Certificate into Mozilla Firefox===

	Importation of a PKCS#12 certificate into the Mozilla Firefox Web Browser application is very simple:		Importation of a PKCS#12 certificate into the Mozilla Firefox Web Browser application is very simple:
Line 438:		Line 438:

	Click OK		Click OK
	You have successfully imported the server's client PKCS#12 certificate into Firefox		You have successfully imported the server's client PKCS#12 certificate into Firefox

	==Importing a Certificate into Evolution==		==Importing a Certificate into Evolution==

Onnowpurbo: /* Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client */

2017-06-11T01:16:21Z

Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client

← Older revision		Revision as of 01:16, 11 June 2017
Line 379:		Line 379:
	==Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client==		==Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client==

	Jika anda bermaksud untuk membuat PKCS#12 certificate dari server Root CA X.509 certificate untuk penggunaan client, anda perlu melakukan proses berikut untuk server certificate dan pasangan kunci tersebut, untuk export sebuah client certificate ~~untuk:~~		Jika anda bermaksud untuk membuat PKCS#12 certificate dari server Root CA X.509 certificate untuk penggunaan client, anda perlu melakukan proses berikut untuk server certificate dan pasangan kunci tersebut, untuk export sebuah client certificate.

	Membuat sebuah file berisi kedua-nya certificate dan key dengan perintah berikut,		Membuat sebuah file berisi kedua-nya certificate dan key dengan perintah berikut,

Onnowpurbo: /* Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client */

2017-06-11T01:16:02Z

Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client

← Older revision		Revision as of 01:16, 11 June 2017
Line 379:		Line 379:
	==Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client==		==Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client==

	~~If you wish to generate~~ PKCS#12 ~~certificates from your~~ server's Root CA X.509 certificate ~~for~~ client ~~use~~, ~~you will need to use the following process on the particular~~ server certificate, ~~and key pair you desire to~~ export a client certificate ~~for~~:		Jika anda bermaksud untuk membuat PKCS#12 certificate dari server Root CA X.509 certificate untuk penggunaan client, anda perlu melakukan proses berikut untuk server certificate dan pasangan kunci tersebut, untuk export sebuah client certificate untuk:

	~~Create a single~~ file ~~containing both the~~ certificate, ~~and key with the following command:~~		Membuat sebuah file berisi kedua-nya certificate dan key dengan perintah berikut,

	openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mycert.pem -out mycert.pem		openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

	~~Then~~, ~~convert this~~ certificate / key ~~combination file into the~~ PKCS#12 certificate ~~with the following command:~~		Kemudian, konversikan file kombinasi certificate / key ke PKCS#12 certificate menggunakan perintah,

	openssl pkcs12 -export -out mycert.pfx -in mycert.pem -name "Certificate for Whatever"		openssl pkcs12 -export -out mycert.pfx -in mycert.pem -name "Certificate for Whatever"

	~~You will be prompted for an~~ Export password, ~~which you may use~~, ~~or just leave blank~~.		Anda akan ditanyakan Export password, yang bisa anda isi, atau biarkan kosong.

	~~The resultant~~ mycert.pfx ~~file may now be imported into applications such as~~ Web Browsers, ~~and~~ E-Mail ~~clients~~. ~~Since this certificate represents the~~ Root CA ~~certificate of your~~ server, ~~all subsequent~~ server~~-level certificates signed by the~~ CA ~~certificate will also be automatically accepted by the client application which installs this~~ PKCS#12 ~~version of the certificate~~.		File mycert.pfx yang dihasilkan sekarang dapat diimpor ke aplikasi seperti Web Browsers, dan klien E-Mail. Karena sertifikat ini mewakili sertifikat Root CA dari server anda, semua sertifikat tingkat server berikutnya yang ditandatangani oleh sertifikat CA juga akan diterima secara otomatis oleh aplikasi klien yang menginstal sertifikat PKCS # 12 ini.

	==Generating Certificate for Signing by Recognized CA==		==Generating Certificate for Signing by Recognized CA==

Onnowpurbo: /* Optional Step for Certain Server Applications */

2017-06-11T01:12:11Z

Optional Step for Certain Server Applications

← Older revision		Revision as of 01:12, 11 June 2017
Line 369:		Line 369:
	server_key.pem : Server application key file		server_key.pem : Server application key file

	==Optional Step ~~for~~ Certain Server ~~Applications~~==		==Optional Step untuk Certain Server Application==

	~~Some~~ server ~~applications~~, ~~such as the~~ Courier IMAP mail server application ~~require that the~~ unencrypted private key ~~be prepended to the~~ server certificate. ~~To accomplish this~~, ~~simply enter the following commands:~~		Beberapa aplikasi server, seperti Courier IMAP mail server application membutuhkan unencrypted private key di tambahkan pada server certificate. Ini dapat dilakukan menggunakan perintah,

	cat server_key.pem server_crt.pem > hold.pem		cat server_key.pem server_crt.pem > hold.pem
Line 377:		Line 377:
	chmod 400 server_crt.pem		chmod 400 server_crt.pem

	~~Converting~~ X.509 ~~Certificates to~~ PKCS#12 ~~for~~ Client ~~Applications~~		==Mengubah X.509 Certificate ke PKCS#12 untuk aplikasi Client==

	If you wish to generate PKCS#12 certificates from your server's Root CA X.509 certificate for client use, you will need to use the following process on the particular server certificate, and key pair you desire to export a client certificate for:		If you wish to generate PKCS#12 certificates from your server's Root CA X.509 certificate for client use, you will need to use the following process on the particular server certificate, and key pair you desire to export a client certificate for: