Installation notice
-------------------
General note
~~~~~~~~~~~~
# Encoding format UTF-8 / PC
# File contents Installation howto
# Official Web site http://www.pki.online.fr/
# Author's Web site http://www.cymc.online.fr/
# Downloading sites See the links heading on the Web site
# Development Cedric CLEMENT - cedric.clement@gmail.com
Thanks to Sebastien PUJADAS for always up-to-date OpenSSL compilation
Thanks to Pierre LAGNIER for Time-stamping service debugging help
Thanks to Thomas ROHDE for the german translation
Presentation
~~~~~~~~~~~~
openWebPKI is a free and open source PKI solution which can be used to generate X.509 certificates based on
French e-Government standard profiles (the RGS v2.2 recommendation published by the DGME, formerly known as
the ADAE), and manage their life-cycle using a web-based interface. openWebPKI was designed to be a user-
friendly, turnkey solution (as opposed to other pieces of software). openWebPKI is fully based on open source
software, including Apache, PHP and OpenSSL.
openWebPKI uses plain text files to store data (as opposed to a RDBMS or LDAP directory), as such the
management of concurrent accesses is limited.
License for use and distribution
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This package is free open source software. You can redistribute it under the terms of by-nc-nd
license published by the Creative Commons corporation either version 3.0 or any later version.
Online license availability: http://creativecommons.org/licenses/by-nc-nd/3.0/legalcode
This program is distributed in the hope that it will be useful, but without any warranty, without
even the implied warranty of merchantability or fitness for a particular purpose. See the Creative
Commons by-nc-nd License for more details.
This software package uses strong cryptography, so even if it is created, maintained and distributed
from liberal countries in Europe (where it is legal to do this), it falls under certain export/import
and/or use restrictions in some other parts of the world.
Please remember that export/import and/or use of strong cryptography software, providing cryptography
hooks or even just communicating technical details about cryptography software is illegal in some parts
of the world. So, when you import this package to your country, re-distribute it from there or even just
email technical suggestions or even source patches to the author or other people you are strongly advised
to pay close attention to any export/import and/or use laws which apply to you. The author of openWebPKI
and OpenSSL are not liable for any violations you make here. So be careful, it is your responsibility.
Disclaimer
~~~~~~~~~~
The author provides absolutely no warranty whatsoever regarding the use of openWebPKI. This solution should
not be used in a production environment without carrying out a proper risk analysis beforehand, and the
operational use of the solution should take into consideration the security stakes at hand, as prescribed
and endorsed by e.g. the Certificate Authority's Certification Policy, a full-scale audit of the assets that
are to be protected by the delivered certificates. The author shall not be liable for any indirect, special,
incidental, punitive, cover or consequential damages (including, but not limited to, damages for the inability
to use equipment or access data, loss of business, loss of profits, business interruption or the like),
arising out of the use of, or inability to use, openWebPKI and based on any theory of liability including
breach of contract, breach of warranty, tort (including negligence), product liability or otherwise, even if
the author has been advised of the possibility of such damages and even if a remedy set forth herein is found
to have failed of its essential purpose.
Technical requirements
~~~~~~~~~~~~~~~~~~~~~~
In order to run, the module openWebPKI needs a minima the following configuration:
# Web server:
- Apache v2.x or higher
- Scripts interpreter: PHP v5.x or higher
- Compression tool: 7-Zip v4.x or higher
# Cryptographic tools:
- OpenSSL v0.9.x or higher: executable, libraries, Apache module & PHP extension
- Message digest algorithms JavaScript implementation: SHA-256 v0.3 by Angel Marin & Paul Johnston
- MCrypt & CrackLib: libraries & PHP extensions
- Encryption: Rijndael (~ AES) or 3-DES (datas encipherment)
# Apache modules: # PHP extensions:
- mod_authz_host - mod_env - php_mbstring
- mod_actions - mod_log_config - php_openssl
- mod_alias - mod_mime
- mod_auth_digest - mod_mime_magic
- mod_cgi - mod_negotiation
- mod_dir - mod_setenvif
- mod_ssl
# Client browser abilities:
- Scripting: Javascript v1.6 & VBscript v5.6 (optional)
- Presentation layer: XHTML v1.1, CSS v3.0 & DHTML
- Databases & configuration: XML v1.1 & XML Schema v1.1
- Communication: SSL v3.0 128 bits (HTTPs) & XMLHTTPRequest compliance (Ajax)
- Encryption: SHA-256 availability (FF & IE with Windows XP SP3 or Vista)
Automated installation
~~~~~~~~~~~~~~~~~~~~~~
Currently, this installation is only available under Microsoft Operating Systems.
The archive gathers every required component.
1. Getting of the full distribution:
- Archive download
- Uncompressing into the folder [ C:\Program Files\ ]
2. Launching of the script [ C:\Program Files\Apache\bin\install.bat ] and thus following of the procedure:
- 7-Zip, OpenSSL & dependencies installation
- Key Ceremony script launching ([ \openWebPKI\private\kc.php ])
- SSL server certificate generation
- Apache service installation & launching
3. Finally, connection to the openWebPKI Web user interface:
- Access: defined URL (default [ https://127.0.0.1/ ])
- Login: defined user (default [ operator ] - /!\ case sensitive)
- Password: defined password (default [ openWebPKI ] - /!\ case sensitive)
Important notes
~~~~~~~~~~~~~~~
# The XML file [ C:\Program Files\Apache\openWebPKI\private\config.xml ] allows you to configure and to
customize the default user, paths, passwords logging, certificates profiles & Authorities hierarchy...
# The shell script [ C:\Program Files\Apache\bin\install.bat ] has currently only been validated under
Windows XP. On line number [ 6 ], the first argument [ operator ] indicates the operator user account,
the second one [ openWebPKI ] indicates the CA unique password used for cryptograhic operations. Change
this argument before launching the key Ceremony script in order to modify these default parameters !
# The previous shell script calls the PHP script [ C:\Program Files\Apache\openwebpki\private\kc.php ]
which allows you to play again the key ceremony (every previous datas will be crushed).
# The PHP script [ C:\Program Files\Apache\openwebpki\private\reset.php ]
allows you to reset the whole module in case of wrong way of use.
# The time-stamping service is available following the next URL: [ https://[FQDN]/ts.php ]
# The CRL distribution points are available following the URL: [https://[FQDN]/[PUBLIC]/[ca-id]-last.crl]
# The shell script [ C:\Progra~1\Apache\openWebPKI\private\ocsp.bat ]
allows you to launch the OCSP responder service for each authority.
# A basic OCSP testing request may be find here: [ C:\Progra~1\Apache\openWebPKI\private\ocspreq.bat ]
# A basic TSA service testing request may be find here: [ C:\Progra~1\Apache\openWebPKI\private\tsr.bat ]
# The shell script [ C:\Program Files\Apache\bin\certs.bat ] allows you to auto-enroll generated certificates
# In order to allow multi-users authentication you should activate Apache SSL user authentication
(<SSLVerifyClient> directive) and check user habilitations through LDAP protocol.
# In order to check the conformity of the generated certificate, CRL or token profiles, the French
e-Government (DGME & ANSSI) toolbox is available following the next URL : http://bao.dgme.fr/
# In order to use SHA-256 under Microsoft Windows XP, you will need to install the Service Pack 3.
# An OpenSSL <ocsp> application limitation is explained here: http://www.nabble.com/OCSP-problems-td23650525.html
# The extensions presented in the request are considered during the certificate profile generation.
---------------
End of document
|
