working

1 files changed, 43 insertions, 54 deletions

diff --git a/docs b/docs
index 68ced06..6cd4500 100644
--- a/docs
+++ b/docs
@@ -1,31 +1,10 @@
 
-nginx handles mtls, and allows connection to local gunicorn instance. If mTLS fails, connection fails and event is logged
-
-
-    ubuntu
-sudo pip install Flask gunicorn  # to install for all users, especially www-data so that the service runs
-  nginx
-install nginx
-sudo systemctl enable --now nginx
-  # cat /var/log/nginx/access.log
-  # /etc/nginx/nginx.conf
-  gunicorn
-gunicorn --bind localhost:5000 app:app           # for testing
-sudo nano /etc/systemd/system/gunicorn1.service  # as a service
-sudo systemctl enable --now gunicorn1            # as a service
-  python
-app1.py
-sudo mkdir /var/www
-sudo chown -R www-data:www-data /var/www
-sudo cp app1.py /var/www
-
-
-  test
+
+
 # private key
 openssl genrsa -out ca.key 2048
 # public certificate
 openssl req -x509 -new -nodes -key ca.key -sha256 -days 1024 -out ca.pem -subj "/C=US/ST=YourState/L=YourCity/O=YourOrg/CN=YourCA"
-
 # server private key
 openssl genrsa -out server.key 2048
 # generate certificate signing request
@@ -39,46 +18,56 @@ openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out c
 
 openssl genrsa -out wrong_client.key 2048
 openssl req -new -x509 -key wrong_client.key -out wrong_client.crt -days 365 -subj "/C=US/ST=State/L=City/O=Organization/CN=incorrectclient"
-
 curl https://127.0.0.1 --cacert ca.pem --cert wrong_client.crt --key wrong_client.key -k
 curl https://127.0.0.1 --cacert ca.pem --cert client.crt --key client.key -k
 
 
-  untested
-sudo cp /path/to/ca.pem /usr/local/share/ca-certificates/your-ca.crt
-sudo update-ca-certificates
-  nginx configuration
-    ocsp server to check that the server is valid
-    crl to check if a client is revoked
-server {
-    listen 443 ssl;
-    server_name yourdomain.com;
+# Allow nginx to connect to any network port for nginx to go through selinux
+also turn off selinux permanently
+sudo setsebool -P httpd_can_network_connect 1  
+sudo mkdir -p /etc/nginx/certs
+sudo cp /flask/v1/keys/* /etc/nginx/certs/
+sudo chown -R nginx:nginx /etc/nginx/certs
+
+# no yubikey verification
+curl https://127.0.0.1/v/0ty2 --cacert ca.pem --cert client.crt --key client.key -k  
+
+# to activate hsm, move these over
+cat server.crt ../intermediate/certs/intermediate.crt ../certs/root.crt > fullchain.crt
+cp fullchain.crt /etc/nginx/certs/hsm_chain.crt
+cp server.crt /etc/nginx/certs/hsm_server.crt
+sudo pkcs11-tool -L  # for denk serial number
+
+
+openssl version -d
+
+edit the openssl.conf file
+/etc/nginx/nginx.conf
+
+then edit the nginx service file
+Environment="OPENSSL_CONF=/etc/pki/tls/openssl.pkcs11.cnf"
+
+add under service
+ systemctl daemon-reload
+ sudo systemctl restart nginx
+
+
+ openssl s_client -connect localhost:443 -cert client.crt -key client.key -CAfile /etc/nginx/certs/hsm_chain.crt
+
+ curl --cert client.crt --key client.key --cacert /etc/nginx/certs/hsm_chain.crt https://localhost:443/ -k
+
 
-    ssl_certificate /path/to/your/server.crt;
-    ssl_certificate_key /path/to/your/server.key;
+ sudo -u nginx pkcs11-tool --module /usr/lib64/opensc-pkcs11.so --list-objects --login
 
-    # Client certificate verification
-    ssl_client_certificate /path/to/your/ca.pem;
-    ssl_verify_client on;
+tail -f /var/log/nginx/error.log  # to see ssl errors
 
-    # Enable OCSP stapling and strict verification
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    ssl_trusted_certificate /path/to/your/ca.pem;
+/usr/share/polkit-1/actions/org.debian.pcsc-lite.policy
+change all to yes then restart systemctl pcscd
+if nginx cannot access pcscd(can also prove this by doing a pkcs11-tool list), systemctl pcscd will have error logs)
 
-    # Specify resolver for OCSP stapling
-    resolver 8.8.8.8 8.8.4.4 valid=300s;
-    resolver_timeout 10s;
 
-    # Enforce OCSP response checking strictly
-    ssl_ocsp on;
-    ssl_ocsp_fail closed;
 
-    # Specify CRL file for client certificate revocation checking
-    ssl_crl /etc/nginx/ssl/crl.pem;
+  https://www.redhat.com/en/blog/controlling-access-smart-cards
 
-    location / {
-        try_files $uri $uri/ =404;
-    }
-}
 
+sudo curl -vvv  -E 'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=00000000;token=user2;pin-value=123456' --cacert fullchain2.crt https://p.0nom.ch/c