[Day 12] 1. Adding another client PKI Lab

To create and configure a new client with your Root CA and Sub CA in a Public Key Infrastructure (PKI) setup, follow the steps below:

Step 1: Create a New Client

Generate a Private Key for the Client:

Use OpenSSL to generate a private key for the new client:

bash
openssl genpkey -algorithm RSA -out www.shuhari.local.key.pem -aes256

Create a New Certificate Signing Request (CSR):
- Create a CSR for the new client using the private key you just created:
```
bash
openssl req -new -key www.shuhari.local.key.pem -out www.shuhari.local.csr
```
- You will be prompted to enter details like the common name (CN), organization, and location. Make sure to enter the correct details.
Export the CSR:
- The CSR (
```
www.shuhari.local.csr
```
  ) is now ready. This will be exported and imported into the Sub CA.

Step 2: Import the CSR into Sub CA and Issue the Certificate

Import the CSR into Sub CA:

On your Sub CA machine, import the CSR for signing. You can use OpenSSL to create a certificate signed by the Sub CA:

bash
openssl ca -in www.shuhari.local.csr -out www.shuhari.local.crt -cert /path/to/sub_ca_cert.pem -keyfile /path/to/sub_ca_private_key.pem

This will issue the certificate (
```
www.shuhari.local.crt
```
) signed by your Sub CA.

Verify and Issue the Certificate:
- Check the details of the certificate. If everything looks good, click OK to issue the certificate.

Step 3: Export the Signed Certificate from Sub CA

Export the Signed Certificate:

Export the certificate from the Sub CA for chain of trust purposes:

bash
openssl pkcs12 -export -out www.shuhari.local-chain.pem -inkey /path/to/sub_ca_private_key.pem -in www.shuhari.local.crt -certfile /path/to/root_ca_cert.pem

This will create a certificate chain file (
```
www.shuhari.local-chain.pem
```
) that includes both the signed certificate and the intermediate/root CA certificates.

Step 4: Export the Client’s Private Key

Export the Client’s Private Key:

You may need to export the client’s private key in a format that can be imported into a key management system or a certificate store:

bash
openssl pkcs12 -export -out www.shuhari.local.pfx -inkey www.shuhari.local.key.pem -in www.shuhari.local.crt -certfile www.shuhari.local-chain.pem

Step 5: Set Up Apache2 Configuration

Configure Apache2 to Use the Client Certificate:

Assuming you’ve set up Apache2 for your PKI lab, you should configure it to use the client certificate.

Modify your Apache2 SSL configuration to point to the necessary certificate files:

bash
SSLCertificateFile /path/to/www.shuhari.local.crt
SSLCertificateKeyFile /path/to/www.shuhari.local.key.pem
SSLCertificateChainFile /path/to/www.shuhari.local-chain.pem

Test the Configuration:

Ensure that the Apache server is configured properly and restart it:

bash
sudo systemctl restart apache2

Step 6: Ensure Name Resolution

Check Name Resolution:
- Make sure that DNS resolution works correctly, especially for
```
www.shuhari.local
```
  . You can verify this using:
```
bash
nslookup www.shuhari.local
```
Test SSL/TLS Connection:
- Test the client-server connection using
```
curl
```
  or a browser to verify that the SSL/TLS certificate is correctly applied:
```
bash
curl https://www.shuhari.local
```

Files to Export for the Client

```
006-www.xdb
```
: This file is database or a key store related to the client.
```
www.shuhari.local-chain.pem
```
: The certificate chain file.
```
www.shuhari.local.crt
```
: The certificate for the client.
```
www.shuhari.local.key.pem
```
: The private key for the client.
```
www.shuhari.local.pem
```
: A combined certificate file, which may include both the client's certificate and the chain.