This section describes the procedure to generate a private key and a CSR with OpenSSL. This example describes how to replace the security module SIP identity certificate. A similar procedure needs to be followed to replace other identity certificates.
Log in to Avaya Breeze® platform using an SSH connection..
2) Copy the default OpenSSL configuration file to be modified:
Modify the configuration file to meet the certificates attributes needed for each identity certificate.
The following example is for a security module SIP identity certificate.
$ vi /home/cust/openssl_csr.cnf … [ req ] default_bits = 2048 default_md = sha256 default_keyfile = privkey.pem distinguished_name = req_distinguished_name attributes = req_attributes x509_extensions = v3_ca # The extentions to add to the self signed cert … # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. string_mask = utf8only
req_extensions = v3_req # The extensions to add to a certificate request
[alt_names] DNS.1 = example.com # The Avaya Breeze TM SIP domain DNS.2 = sip.example.com # Another Avaya Breeze TM SIP domain IP = 192.168.1.100 # The Avaya Breeze TM SIP interface (eth1) IP address URI.1 = sip:example.com # The Avaya Breeze TM SIP domain preceded by the sip schema URI.2 = sip:sip.example.com # Another Avaya Breeze TM SIP domain preceded by the sip schema …
Note:
Some public CAs do not allow signing a CSR with a Subject Alternative Name extension entry of type URI and SIP scheme (e.g. URI=sip:sip.example.com). In this case, only use the DNS type entry with the corresponding SIP domain. In the above example, remove the lines that start with URI.1 and URI.2.
Generate the CSR and private key.
ADDITIONAL INFORMATION:
The generated CSR file is asm1.csr and the private key is asm1.key. The private key is protected with a passphrase. Remember this passphrase because it will be used to create the PKCS#12 container. The private key file should stay on the server all the time and not distributed. If the private key gets compromised, an attacker could decrypt TLS traffic or impersonate the Avaya Breeze® platform.
$ openssl req -out asm1.csr -new -newkey rsa:2048 -keyout asm1.key -config /home/cust/openssl_csr.cnf Generating a 2048 bit RSA private key ....+++ .............................................+++ writing new private key to 'asm1.key' Enter PEM pass phrase: <<< Private key pass phrase Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:US State or Province Name (full name) []:CO Locality Name (eg, city) [Default City]:Thornton Organization Name (eg, company) [Default Company Ltd]:My example company Organizational Unit Name (eg, section) []:IT Common Name (eg, your name or your server's hostname) []:asm1.example.com <<< Avaya Breeze TM hostname Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
Ensure that the CSR contains the correct attributes by running the following OpenSSL command:
$ openssl req -in asm1.csr -text Certificate Request: Data: Version: 0 (0x0) Subject: C=US, ST=CO, L=Thornton, O=My example company, OU=IT, CN=asm1.example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:f2:d7:35:5a:f9:f7:9f:5f:1e:9e:f5:e0:4f:… Exponent: 65537 (0x10001) Attributes: Requested Extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment, Key Agreement X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Subject Alternative Name: DNS:example.com, DNS:sip.example.com, IP Address:192.168.1.100, URI:sip:example.com, URI:sip:sip.example.com Signature Algorithm: sha256WithRSAEncryption 1f:64:2a:92:89:ce:bd:ff:80:7a:c8:50:7b:f2:bd:80:57:ce:… -----BEGIN CERTIFICATE REQUEST----- MIIDWDCCAkACAQAwcjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNPMREwDwYD… -----END CERTIFICATE REQUEST-----
Send the CSR file asm1.csr to the PKI administrator to get it signed by the third party CA.
