Red Hat NETWORK 4.1.0 - CLIENT Configuration Manual

Also see for NETWORK 4.1.0 -: Manual Reference guide

Contents

Red Hat NETWORK 4.1.0 - CLIENT Configuration Manual Manual pdf 18 page image

14 Chapter 3. SSL Infrastructure• Certificate Authority (CA) SSL private key and public certificate — only one set perorganization generally generated. The public certificate is digitally signed by its privatekey. The public certificate is distributed to every system.• Web server SSL private key and public certificate — one set per application server. Thepublic certificate is digitally signed by both its private key and the CA SSL private key.We often refer to a Web server’s key set; this is because there is an intermediary SSLcertificate request that is generated. The details of what this is used for are not importantto this discussion. All three are deployed to an RHN Server.Here’s a scenario: If you have one RHN Satellite Server and five RHN Proxy Servers, youwill generate one CA SSL key pair and six Web server SSL key sets. The CA SSL publiccertificate is distributed to all systems and used by all clients to establish a connection totheir respective upstream servers. Each server has its own SSL key set that is specificallytied to that server’s hostname and generated using its own SSL private key and the CA SSLprivate key in combination. This establishes a digitally verifiable association between theWeb server’s SSL public certificate and the CA SSL key pair and server’s private key. TheWeb server’s key set cannot be shared with other web servers.ImportantThe most critical portion of this system is the CA SSL key pair. From that private key andpublic certificate an administrator can regenerate any Web server’s SSL key set. This CASSL key pair must be secured. It is highly recommended that once the entire RHN infras-tructure of servers is set up and running, you archive the SSL build directory generatedby this tool and/or the installers onto separate media, write down the CA password, andsecure the media and password in a safe place.3.2. The RHN SSL Maintenance ToolRed Hat Network provides a command line tool to ease management of your secureinfrastructure: the RHN SSL Maintenance Tool, commonly known by its commandrhn-ssl-tool. This tool is available as part of the rhns-certs-tools package.This package can be found within the software channels for the the latest RHN ProxyServer and RHN Satellite Server (as well as the RHN Satellite Server ISO). RHN SSLMaintenance Tool enables you to generate your own Certificate Authority SSL key pair,as well as Web server SSL key sets (sometimes called key pairs).This tool is only a build tool. It generates all of the SSL keys and certificates that arerequired. It also packages the files in RPM format for quick distribution and installation onall client machines. It does not deploy them, however. That is left to the administrator, orin many cases, automated by the RHN Satellite Server.