From 2ff7e5e73768556cef51cb1f8ef079c7d640a315 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 3 Jul 2008 16:50:42 +0200 Subject: finalized tutorial for creating a TLS-secured syslog infrastructure --- doc/tls_cert_machine.html | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'doc/tls_cert_machine.html') diff --git a/doc/tls_cert_machine.html b/doc/tls_cert_machine.html index 0d2955f7..5ecde0d1 100644 --- a/doc/tls_cert_machine.html +++ b/doc/tls_cert_machine.html @@ -36,7 +36,7 @@ src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> be specified inside the $<object>PermittedPeer config statements. -

For now, we assume that that a single person (or group) is responsible for the whole +

For now, we assume that a single person (or group) is responsible for the whole rsyslog system and thus it is OK if that single person is in posession of all machine's private keys. This simplification permits us to use a somewhat less complicated way of generating the machine certificates. So, we generate both the private @@ -56,6 +56,13 @@ breaching your security.

Text in red is user input. Please note that for some questions, there is no user input given. This means the default was accepted by simply pressing the enter key. +

Please note: you need to substitute the names specified below with values +that match your environment. Most importantly, machine.example.net must be replaced +by the actual name of the machine that will be using this certificate. For example, +if you generate a certificate for a machine named "server.example.com", you need +to use that name. If you generate a certificate for "client.example.com", you need +to use this name. Make sure that each machine certificate has a unique name. If not, +you can not apply proper access control. 

 [root@rgf9dev sample]# certtool --generate-privkey --outfile key.pem --bits 2048
 Generating a 2048 bit RSA private key...
@@ -82,7 +89,7 @@ Extensions.
 Does the certificate belong to an authority? (Y/N): n
 Is this a TLS web client certificate? (Y/N): y
 Is this also a TLS web server certificate? (Y/N): y
-Enter the dnsName of the subject of the certificate: machine.example.net
+Enter the dnsName of the subject of the certificate: machine.example.net {This is the name of the machine that will use the certificate}
 Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (Y/N): 
 Will the certificate be used for encryption (RSA ciphersuites)? (Y/N): 
 X.509 Certificate Information:
-- 
cgit v1.2.3