Revision as of 16:43, 12 December 2023

OpenSSL Cheat Sheet

OpenSSL: Criando uma Autoridade Certificadora (CA)

Criando as chaves ssl

openssl req -x509 -nodes -days 3650 -newkey rsa:2048  -keyout nginx.key -out nginx.crt \
  -subj "/C=BR/ST=DF/L=Brasilia/O=Company/OU=TI/CN=$(hostname).company.com.br"

Importando um Certificado

Download do certificado

openssl s_client -connect <HOST:PORT> </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <FILENAME.cer>

Importando via ikeycmd

ikeycmd -cert -add -db "key.jks" -file "FILENAME.cer" -pw <PASSWORD> -label <LABEL_CERTIFICADO> > /dev/null

iKeyCmd Cheat Sheet

List certificates

ikeycmd -cert -list personal -db "key.kdb" -pw changeit

ikeycmd -cert -list ca -db "key.kdb" -pw changeit

Add a client certificate to keystore

ikeycmd -cert -add -db "key.kdb" -label <MYCERTLABEL> -file <FILENAME.crt> -format ascii -pw changeit

Add self-signed certificate to keystore

ikeycmd -certreq -create -db gui-truststore.jks -pw password -size 2048 \
-sig_alg SHA256WithRSA -dn "CN=srv.company.com" -file certreq.csr -label label \
-san_dnsname srv1.company.com,srv2.company.com  \
-san_ipaddr 192.168.2.1,192.168.2.2

Remove certificate from keystore (using stashed password)

ikeycmd -cert -delete -label <MYCERTLABEL> -db "key.kdb" -stashed

Set default certificate

ikeycmd -cert -setdefault -db "key.kdb" -label "mydefaultcertificate" -pw changeit

WLP: Adicionando um certificado TLS como confiável na Liberty trust store

Keytool Cheat Sheet

List certificates

keytool -v -list -keystore <JAVA_HOME>/lib/security/cacerts -storepass changeit

Add a client certificate to keystore

keytool -import -alias certificadointerno -file /<TEMP_DIR>/certificadoInterno.der \
-keystore  <JAVA_HOME>/lib/security/cacerts -storetype jceks \
-storepass changeit -noprompt