Network UPS Tools User Manual
Network UPS Tools User Manual
Network UPS Tools User Manual
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Network</strong> <strong>UPS</strong> <strong>Tools</strong> <strong>User</strong> <strong>Manual</strong> 43 / 84<br />
Create certificate and key for the host<br />
NSS (package generally called libnss3-tools) will install a tool called certutil. It will be used to generate certificates and<br />
manage certificate database.<br />
Certificates should be signed by a certification authorities (CAs). Following commands are typical samples, contact your SSL<br />
guru or security officer to follow your company procedures.<br />
GENERATE A SERVER CERTIFICATE FOR <strong>UPS</strong>D:<br />
• Create a directory where store the certificate database: mkdir cert_db<br />
• Create the certificate database : certutil -N -d cert_db<br />
• Import the CA certificate: certutil -A -d cert_db -n "My Root CA" -t "TC,," -a -i rootca.crt<br />
• Create a server certificate request (here called My nut server): certutil -R -d cert_db -s "CN=My nut serve<br />
r,O=MyCompany,ST=MyState,C=US" -a -o server.req<br />
• Make your CA sign the certificate (produces server.crt)<br />
• Import the signed certificate into server database: certutil -A -d cert_db -n "My nut server" -a -i se<br />
rver.crt -t "„"<br />
• Display the content of certificate server: certutil -L -d cert_db<br />
Clients and servers in the same host could share the same certificate to authenticate them or use different ones in same or different<br />
databases. The same operation can be done in same or different databases to generate other certificates.<br />
Create a self-signed CA certificate<br />
NSS provides a way to create self-signed certificate which can acting as CA certificate, and to sign other certificates with this CA<br />
certificate. This method can be used to provide a CA certification chain without using an "official" certificate authority.<br />
GENERATE A SELF-SIGNED CA CERTIFICATE:<br />
• Create a directory where store the CA certificate database: mkdir CA_db<br />
• Create the certificate database: certutil -N -d CA_db<br />
• Generate a certificate for CA: certutil -S -d CA_db -n "My Root CA" -s "CN=My CA,O=MyCompany,ST=<br />
MyState,C=US" -t "CT,," -x -2 (Do not forget to answer Yes to the question Is this a CA certificate [y/N]?)<br />
• Extract the CA certificate to be able to import it in upsd (or upsmon) certificate database: certutil -L -d CA_db -n<br />
"My Root CA" -a -o rootca.crt<br />
• Sign a certificate request with the CA certificate (simulate a real CA signature): certutil -C -d CA_db -c "My<br />
Root CA" -a -i server.req -o server.crt -2 -6<br />
Install the server-side certificate<br />
Just copy the database directory (just the directory and included 3 database .db files) to the right place, such as /usr/local/<br />
ups/etc/:<br />
mv cert_db /usr/local/ups/etc/
Change language