opennic:tls

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revisionBoth sides next revision
opennic:tls [2021-03-01T08:55:14Z] – [How to get started] new deep42thoughtopennic:tls [2021-03-01T09:07:50Z] – [How to get started] avoid MITM attack deep42thought
Line 14: Line 14:
 The acme server runs on a domain which must be validated by the same root certificate which is used for other opennic domains. The acme server runs on a domain which must be validated by the same root certificate which is used for other opennic domains.
 Thus, one must download the root certificate (and ignore the certificate error on the https connection) and install it as a trusted root certificate. Thus, one must download the root certificate (and ignore the certificate error on the https connection) and install it as a trusted root certificate.
 +If you like to avoid possible MITM attacks on the download, you can verify the [[https://eckner.net/certs/sha512sums|sha512sum]] of the certificate, too (this file also contains checksums for older and for an unrelated ca). On arch linux, one would run:
 <code> <code>
-curl --insecure -o /usr/share/ca-certificates/trust-source/anchors/opennic_root_ca.crt https://playground.acme.libre/opennic_root_ca.crt+cd /usr/share/ca-certificates/trust-source/anchors 
 +curl --insecure -o opennic_root_ca.crt https://playground.acme.libre/opennic_root_ca.crt 
 +curl https://eckner.net/certs/sha512sums | sed 's/  \S\+\(opennic_root_ca\.crt\)$/  \1/;t;d' | sha512sum -c
 trust extract-compat trust extract-compat
 </code> </code>
  • /wiki/data/pages/opennic/tls.txt
  • Last modified: 3 years ago
  • by marek