Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Last revisionBoth sides next revision
opennic:tls [2021-03-01T08:55:14Z] – [How to get started] new deep42thoughtopennic:tls [2021-08-06T04:04:04Z] – [How to get started] deep42thought
Line 14: Line 14:
 The acme server runs on a domain which must be validated by the same root certificate which is used for other opennic domains. The acme server runs on a domain which must be validated by the same root certificate which is used for other opennic domains.
 Thus, one must download the root certificate (and ignore the certificate error on the https connection) and install it as a trusted root certificate. Thus, one must download the root certificate (and ignore the certificate error on the https connection) and install it as a trusted root certificate.
 +If you like to avoid possible MITM attacks on the download, you can verify the [[https://eckner.net/certs/sha512sums|sha512sum]] of the certificate, too (this file also contains checksums for older and for an unrelated ca). On arch linux, one would run:
 <code> <code>
-curl --insecure -o /usr/share/ca-certificates/trust-source/anchors/opennic_root_ca.crt https://playground.acme.libre/opennic_root_ca.crt+cd /usr/share/ca-certificates/trust-source/anchors 
 +curl --insecure -o opennic_root_ca.crt https://playground.acme.libre/opennic_root_ca.crt 
 +curl https://eckner.net/certs/sha512sums | sed 's/  \S\+\(opennic_root_ca\.crt\)$/  \1/;t;d' | sha512sum -c
 trust extract-compat trust extract-compat
 +</code>
 +On debian, the commands are rather:
 +<code>
 +cd /usr/share/local/ca-certificates/trust-source/anchors
 +curl --insecure -o opennic_root_ca.crt https://playground.acme.libre/opennic_root_ca.crt
 +curl https://eckner.net/certs/sha512sums | sed 's/  \S\+\(opennic_root_ca\.crt\)$/  \1/;t;d' | sha512sum -c
 +update-ca-certificates
 </code> </code>
 Check, that the certificate was installed correctly: Check, that the certificate was installed correctly:
  • /wiki/data/pages/opennic/tls.txt
  • Last modified: 3 years ago
  • by marek