``CAU`` is going to be used to execute Certificate Authority for Users, and ``CASE`` for Certificate Authority for SErvices. As server is going to be just running, there is no need for special environment variable.
``CAU`` is going to be used to execute Certificate Authority for Users, and ``CAS`` for Certificate Authority for SErvices. As server is going to be just running, there is no need for special environment variable.
Let's start a server, which will approve automatically one user certificate -- if you're lucky, it will be yours::
Let's start a server in separate terminal, which will approve automatically one user certificate -- if you're lucky, it will be yours::
@@ -167,7 +169,7 @@ It will return its id and path, so fetch it with the id::
$CAU --mode user --send-csr user/client.csr.pem --get-crt <user-cert-id> user/client.key.pem
Voila, you have your key signed by caucase you started, and you became master of the caucase.
Voila, you have your key signed by caucase you started, and you became user of this caucase, so you now have the power to decide which service certificate requests will be granted and which will be rejected.
Let's create key for the service::
...
...
@@ -175,16 +177,20 @@ Let's create key for the service::
And now as a service, let's ask caucase for signing::
$CASE --send-csr service/csr.pem
$CAS --send-csr service/csr.pem
Again store the id. Let's ask for the certificate immediately::
Again remember the id. Let's ask for the certificate immediately::
$CASE --get-crt <service-cert-id> service/crt.pem
$CAS --get-crt <service-cert-id> service/crt.pem
The reply is::
<service_id> CSR still pending
You might end up in situation with bad network, so there is nothing wrong with asking the server again to sign the certificate, it will return the same id::
$CAS --send-csr service/csr.pem
Now using user certificate, but in ``--mode service``, which is default, let's see what is to sign::
$CAU --user-key user/client.key.pem --list-csr
...
...
@@ -200,7 +206,7 @@ As they say, you shall fetch the CSR and check the full content::