j3g
/
pki-bootstrap_pub
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
PKI Bootstrap. Will generate a new "PKI Lifecycle" package. An entire PKI chain of trust can be managed by the "PKI Lifecycle" package.
20 Commits 5 Branches 0 Tags 805 KiB
Shell 100%
Go to file
JohnE 5366ef101d FIN: refactoring complete, serial #s are all coherent, distinguished names (DN) is strong with both CA-I serial #s and client/server serial #s 2018-09-10 19:09:48 -07:00
docs FIN: refactoring complete, serial #s are all coherent, distinguished names (DN) is strong with both CA-I serial #s and client/server serial #s 2018-09-10 19:09:48 -07:00
src FIN: refactoring complete, serial #s are all coherent, distinguished names (DN) is strong with both CA-I serial #s and client/server serial #s 2018-09-10 19:09:48 -07:00
.gitignore FIN: refactoring complete, serial #s are all coherent, distinguished names (DN) is strong with both CA-I serial #s and client/server serial #s 2018-09-10 19:09:48 -07:00
README FIN: completed the gen_ca-i.sh refactoring, CA-Is are generated from the Lifecycle package now! :) 2018-08-23 20:14:13 -07:00

README 

      ===============================================
        Certificate Authority (CA) Generation
        CA Intermediate Generation and Distribution
        Project ReadMe
          Version 3.x
      ===============================================


-------------
  INTRO
-------------

This package contains a set of programs to generate an entire certificate chain of trust
 and will configure StrongSwan server. .p12 files are generated for client distribution.

There are two main applications contained in this project.
  * PKI Bootstrap : MOB Hub System
    - 1 x Certificate Authority (CA) generation
    - 5 x CA Intermediate generation
    - 10 x Server and Client certificate generation (based on CA-I)
    - CA, CA-I, Server, and Client certificate packaged as .p12 file for easy import to Android (other clients too)

  * PKI Lifecycle : MOB Hub System
    - Unlimited CA Intermediate generation
    - Unlimited Server and Client generation (based on CA-I)



---------------------
  VERSIONS
---------------------

Ver 3.2 - MOB Hub PKI Lifecycle
  * PKI Lifecycle
    - generate certificates during the CA's lifecycle
Ver 3.1 - MOB Hub PKI Bootstrap
  * PKI Bootstrap
    - generate an entire chain-of-trust
Ver 3.0 - CA Intermediate Support
  * requires openssl  (does not require ipsec)
  * CA Intermediate support
    -root CA can be generated with 5-10yr expiration, put into cold-storage
  * small to large organizational support



---------------------
  TODO
---------------------
  * SCEP support



---------------------
  TROUBLESHOOTING
---------------------

1) Look at the error log for detailed information:
  $ tail -n 40 /var/log/syslog

2) Check the date/time of the device. A common problem is a certificate date/time valid range issue. 
Make sure your server date is within the CA, and Server certificate valid date.



----------------
  METHODOLOGY
----------------