Creating certificates with a password that has spaces in it
Hi, I am setting up FreeRadius on a FreeBSD system in an EAP-TLS configuration. As part of that process, I need to create a number of certificates. To do so, I am following the instructions detailed in the README file (in the /usr/local/etc/raddb/certs folder). The passwords i've set in the three CNF files are made up of multiple words. However, when I try and execute the "make server.pem" command, I get an error. As a test, I set the input and output passwords both to "One Two Three 4" in the ca.cnf file, and executed the "make ca.pem" and "make ca.der" steps successfully. When I tried to execute "make server.pem" however... =====8<===== [root@server certs]# make server.pem /usr/local/bin/openssl req -new -out server.csr -keyout server.key -config ./se rver.cnf Generating a 2048 bit RSA private key ................................+++ .............................................................+++ writing new private key to 'server.key' ----- /usr/local/bin/openssl ca -batch -keyfile ca.key -cert ca.pem -in erver.csr -k ey `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extens ions xpserver_ext -extfile xpextensions -config ./server.cnf unknown option Two usage: ca args =====8<===== The "unknown options Two" line suggests that only the first word of the password is used and that openssl thinks the rest of the password are other parameters. I've tried enclosing the passwords (in the CNF files) in both single quotes and double quotes, but have had no success. Is it possible to create certificates with passwords that have spaces in them, using these make commands? Regards, Jazz
On Dec 9, 2014, at 3:38 PM, Jasvinder S. Bahra <bbdl21548@blueyonder.co.uk> wrote:
The passwords i've set in the three CNF files are made up of multiple words
The build rules in raddb/certs/ are meant for simple cases, no spaces. In any case, I’ve pushed a fix to the various branches. You can download a patch for v2 here: https://github.com/FreeRADIUS/freeradius-server/commit/252275d01ac9203d40990... Save it to a file in the raddb directory, and then in shell prompt (in that directory), do: patch -p2 < 252275d01ac9203d4099037040f69765930d146f.patch After that, it should work. Alan DeKok.
Alan, I didn't mention this in my original e-mail, but i'm using version 3.0.4. Stefan's suggestion seems to have resolved the problem, but its good to know that no one else will run into this problem. Regards, Jazz ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, December 09, 2014 9:01 PM Subject: Re: Creating certificates with a password that has spaces in it On Dec 9, 2014, at 3:38 PM, Jasvinder S. Bahra <bbdl21548@blueyonder.co.uk> wrote:
The passwords i've set in the three CNF files are made up of multiple words
The build rules in raddb/certs/ are meant for simple cases, no spaces. In any case, I’ve pushed a fix to the various branches. You can download a patch for v2 here: https://github.com/FreeRADIUS/freeradius-server/commit/252275d01ac9203d40990... Save it to a file in the raddb directory, and then in shell prompt (in that directory), do: patch -p2 < 252275d01ac9203d4099037040f69765930d146f.patch After that, it should work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 9 Dec 2014, at 20:38, Jasvinder S. Bahra <bbdl21548@blueyonder.co.uk> wrote:
The "unknown options Two" line suggests that only the first word of the password is used and that openssl thinks the rest of the password are other parameters. I've tried enclosing the passwords (in the CNF files) in both single quotes and double quotes, but have had no success. Is it possible to create certificates with passwords that have spaces in them, using these make commands?
Jazz, try the following: In /etc/raddb/Makefile, edit lines 74, 77, and 80. Put quotes around the $(PASSWORD_CA) and $(PASSWORD_SERVER) items. Do the same in lines 96, 99 and 102 with $(PASSWORD_CA) and $(PASSWORD_CLIENT). Does that fix the problem? Please let us know on here. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
Stefan, Those changes do indeed fix the problem - thanks for chiming in *smiles*. Regards, Jazz ----- Original Message ----- From: "Stefan Paetow" <Stefan.Paetow@jisc.ac.uk> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, December 09, 2014 9:05 PM Subject: Re: Creating certificates with a password that has spaces in it Jazz, try the following: In /etc/raddb/Makefile, edit lines 74, 77, and 80. Put quotes around the $(PASSWORD_CA) and $(PASSWORD_SERVER) items. Do the same in lines 96, 99 and 102 with $(PASSWORD_CA) and $(PASSWORD_CLIENT). Does that fix the problem? Please let us know on here. Stefan Paetow Moonshot Industry & Research Liaison Coordinator
participants (3)
-
Alan DeKok -
Jasvinder S. Bahra -
Stefan Paetow