How to create self-signed certificates with the XCA tool in order to set them up on Olfeo for SSL decryption.

Objective

Create the certificates required for the SSL decryption component to function under Linux.

STEPS

1. Run the following command to create a valid self-signed certificate, for example, 365 days:
   openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout myKey.pem -out myCA.pem

   NB: Please note the limitations set by Apple formacOS and iOS: the validity period of a certificate must be less than 398 days.
   source: https://support.apple.com/fr-fr/102028

2. Explanations of these different options:
   • The req command creates and processes certificate-related requests.
   • The -new parameter corresponds to a request to create a new certificate. The user will then be asked to provide the necessary field values.
   • The -newkey parameter creates a new certificate request and a new private key. It is associated with the value rsa:2048, which corresponds to the size of the private key.
   • When the -x509 option is used, the -days parameter specifies the number of days for which the certificate will be certified.
   • The -node parameter allows you to not encrypt the private key.
   • The -keyout parameter allows you to specify the file name where the created private key will be written.
   • The parameter -out allows you to specify the name of the file where the created certificate will be written.

     For other options, OpenSSL relies on the values specified in the configuration file: /etc/ssl/openssl.cnf

     For example, the default signature algorithm (sha256) is specified in this configuration file:

      

3. When executing this command, the administrator must provide the information that will be included in the characteristics of the generated certificate:
   Country Name (2-letter code) [AU]:
   State or Province Name (full name) [Some-State]:
   Locality Name (e.g., city):
   Organization Name (e.g., company) [Internet Widgits Pty Ltd]:
   Organizational Unit Name (e.g., section):
   Common Name (e.g., YOUR name):
   Email Address []:

   Example: 

   
   See the complete OpenSSL documentation: https://www.openssl.org/docs/man1.0.2/man1/openssl-req.html 

4. Transfer the certificate and key (*.pem files) to your machine using WinSCP, for example.

5. In the Olfeo administration interface, import the certificate and key into the SSL decryption configuration.

6. On the client side, import the certificate into the certificate stores. This operation can be performed by GPO or locally:

   Firefox: Be sure to select the Authorities tab:

   

   Then check Confirm this CA to identify websites.

   

   Internet Explorer / Chrome / Edge: Tools > Internet Options > Content > Certificates, then the Trusted Certification Authorities tab:

   

VALIDATION

Launch Internet Explorer or Firefox, then connect to an HTTPS site. In the access.log, you will see access to the HTTPS site with a CONNECT, followed by the same site with a GET: