Manifesto for International Data Spaces
Edit

Certificate Authority (CA)

Description

This software is intended to be used as a mock CA for test environments. It does not offer any security guarantees and must not be used in productive environments.

Please, note that this document is only required for those end users who want to create and use different certificates for the deployment of IDS-testbed components.

Scope

This software simulates a PKI with root CAs, intermediate CAs and device certificates, including at the device certificates the AIA (Authority Information Access) extension information.

Generate certificates

At this step, all the neccessary certificates are generated for the use of IDS-testbed components.

./setup_PKI.sh {FOLDER_TO_BE_CREATED}

It could look something like this:

./setup_PKI.sh data-cfssl

Revoke certificates

At this section, it is detailed the neccessary steps to manually revoke any of the previous step generated certificates. For the already existent folder "data-cfssl", the following certificate is revoked "connectorArevoked".

The steps required to revoke a certificate are detailed at the following commands which need to be executed inside "data-cfssl" folder where the certificates are located.

cd data-cfssl
# Obtain certificate information to extract serial and AKI number identifiers.
cfssl certinfo -cert certs/connectorArevoked.pem
# Command to revoke the certificate
# cfssl revoke -db-config ocsp/sqlite_db_components.json -serial {SERIAL_NUMBER} -aki {AKI_CERTIFICATE} -reason={REASON}
# where AKI must be included as shown by certinfo without ":" and with all lowercase letters.
# It could look something like this for the connectorArevoked certificate
cfssl revoke -db-config ocsp/sqlite_db_components.json -serial "581921879588615033625472730240878974097738102962" -aki "c476d0aacd9379350feba7646090a46bb4384d33" -reason="superseded"

Refresh the OCSP server to include the changes

Open a terminal at "data-cfssl" folder and execute the following commands:

Verify the changes against the OCSP server

The following commands performs a check against the OCSP server to verify the revocation status of a certificate.

It could look something like this:

Extra commands for device certificates

At this section it is included the neccessary commands in order to obtain the certificates extensions required by IDS-testbed components for their implementation.

Extra commands for CA certificate

Extra commands for subCA certificate

Last updated