Anyone updated the certificate keys for Adito, Openvpn ALS

[edutech4schools]

I am playing with Adito, which is a mighty fantastic vpn / rdp tool, but the default certificate key is not very secure.

 

I am looking at ways of updating the cert keys and wondered if anyone had done this already? If so do you have any pointers.

 

Thanks

[glennda]

I did do it, it was very fiddly but possible,

 

I can't remember how I think just generated new csr using openssl.

 

Toby

[edutech4schools]

Not having done anything like this before so might need a bit of help.

 

The school do not have a signed cert so I will be creating a self signed cert. I found a few free programs that can do this like openssl but also found this tool,

KeyStore Explorer - Home KeyTool explorer which looks like it uses the same java key system as Adito.

 

I am not 100% sure what to do next and I cant seem to find much info on the net.

 

I will play and see what I can come up with, but if you have any advice before I start it would be very welcome.

[glennda]

Rather then use self signed get one.from IPSCA they are free but are only trusted on Windows and but not in ff.

 

Free for education

[jamesfed]

JANET do free certs for schools now - just apply through your LEA/Broadband Consortium

[edutech4schools]

on the IPSCA website it says:

 

All certificate requests (CSR) must contain an Organization Name (O) that is exactly the same that appears at public domain name registries as the owner of the domain. The company name IN THIS FORM and contact information must also be the same.

 

Do they simply need the full school name or the registered domain name which would be schoolname.sch.uk

[edutech4schools]

Also on the cert form it asks for server type and gives a long list of server types. What would you recommend for Adito? I am running Adito on a win XP box if that makes any difference.

 

Thanks

[glennda]

Also on the cert form it asks for server type and gives a long list of server types. What would you recommend for Adito? I am running Adito on a win XP box if that makes any difference.

 

Thanks

 

erm I think i just put other - I also needed to convert the cert using this and the IPSCA global root cert

 

https://www.sslshopper.com/ssl-converter.html

 

with regards to the OU name its what is registered with nominet as. for Example here, mines The Weald School.

[edutech4schools]

Thank you for your help so far glennda.

 

I have another few question, hopefully I will not need to bother you to much after this.

 

On the cert request page it is asking me to paste my csr info in to a blank box. What is the best way to get the csr?

 

I was also wondering if Adito has a favourite key length, the certs come with a minimum of 1024-bit. What would you recommend?

[glennda]

Adito will generate the CSR for you, if you log in as admin under configuration is SSL certificates and then top right is download CSR.

 

Adito will give you the key at 1024.

 

Toby

[edutech4schools]

Just sent the cert request, so fingers crossed.

[edutech4schools]

ok got my certificates.

 

Do you have any step by steps for the next few stages?

 

After downloading the cert I was asked to rename it to .cer or .crt The .crt is for apache. Do you know which I should choose.

 

Next I presume it needs to be converted using the website tool you posted. So I might have a few other questions.

 

Thanks for the help so far.

[edutech4schools]

Well I am having a major issue trying to convert the cert.

 

https://www.sslshopper.com/ssl-converter.html

 

I upload the cert to be converted as a PEM (is this correct)

I then select PKCS#12 as the format I need (is this correct)

 

It then asks for

Privet key file

chain cert file (optional)

chain cert file 2 (optional)

 

from the cert company I have downloaded

cert.cer

ipsCAGlobal.crt

ipsCALEVEL1CA.crt

 

I also downloaded a bundle file that has both ipsCAGlobal.crt and ipsCALEVEL1CA.crt in one.

 

I am getting this error

There was a problem converting that certificate. It may be corrupt or it may be in a different format than the one you selected.

 

I just seem to be going round and round and really need some help.

[glennda]

I'm pretty sure thats all i did - have you treid with just one of the chain cert files? the IPSCALevel1CA crt and just your cert?

[edutech4schools]

Which file should I upload for the Privet key file?

[glennda]

One of the options from the Adito SSl certs page is to download the private key.

[edutech4schools]

Still no joy trying to convert.

 

Just jumping ahead, when it comes to importing the cert in to Adito which method or methods do I choose

Choose the type of certificate or key you are going to import.

[TABLE=width: 100%]

[TR=class: formRadio]

[TD=class: value] A reply from a certification authority[/TD]

[/TR]

[TR=class: formRadio]

[TD=class: value] A certificate from a server you wish to trust.[/TD]

[/TR]

[TR=class: formRadio]

Edited April 18, 2012 by edutech4schools

[edutech4schools]

sorry should be

 

A reply from a certification authority

A root certificate for your web servers certification authority.

A certificate from a server you wish to trust.

A key for a server that requires client certificate authentication.

[edutech4schools]

ok just found this info

If you import

A reply from a CA, it should be in the DER format.

 

going to try later.

 

the info was on this page and goes on about lots of stuff I do not understand. maybe someone who understands this can check it out.

[edutech4schools]

OK the converter worked for the DER format which only needed the cert file, but Adito does not like it.

 

This is stating to wind me up.

 

If someone can get this working for me I will send them £30 via paypal or bank transfer.

[edutech4schools]

glennda pm sent.

[edutech4schools]

Thanks to glennda who helped me sort this out. All working how I wanted. I have got to do the same at some other schools so will post a step by step at some point.