I became my own certificate authority after running through the tutorial at: https://jamielinux.com/docs/openssl-certificate-authority/
I created a root pair, created an intermediate pair, and signed a server certificate, which I installed on squid like this:
http_port 3129 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid3/certs/gatesentry.csr.cert.pem key=/etc/squid3/key/gatesentry.key.pem
Squid starts up just fine with this. Still not sure if it's actually working or not.
When I try to generate a client-side certificate to install in a browser that will be accessing the internet through the proxy I end up with an error:
I generate it based on the "Sign server and client certificates" section that reads "Create a certificate"
It states that if I'm going to create a client certificate for authentication, I'll need to use the 'usr_crt' extension and so I run:
cd /root/ca openssl ca -config intermediate/openssl.conf \ -extensions usr_cert -days 375 -notext -md sha256 \ -in intermediate/csr/gatesentry.csr.pem \ -out intermediate/certs/client.cert.pem Using configuration from intermediate/openssl.conf Enter pass phrase for /root/ca/intermediate/private/intermediate.key.pem: Check that the request matches the signature Signature ok Certificate Details: Serial Number: 4097 (0x1001) Validity Not Before: Jun 22 10:36:44 2016 GMT Not After : Jul 2 10:36:44 2017 GMT Subject: countryName = US stateOrProvinceName = Pennsylvania localityName = locality organizationName = Parents organizationalUnitName = Security commonName = gatesentry.domain.lan emailAddress = email@example.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Client, S/MIME Netscape Comment: OpenSSL Generated Client Certificate X509v3 Subject Key Identifier: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX X509v3 Authority Key Identifier: keyid:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX X509v3 Key Usage: critical Digital Signature, Non Repudiation, Key Encipherment X509v3 Extended Key Usage: TLS Web Client Authentication, E-mail Protection Certificate is to be certified until Jul 2 10:36:44 2017 GMT (375 days) Sign the certificate? [y/n]: y failed to update database TXT_DB error number 2
I don't understand why I am getting the TXT_DB error number 2 message when I am running the command as root (on another machine of course).
According to the tutorial, I should be able to change the Common Name during this process.