[asterisk-commits] twilson: trunk r292743 - in /trunk: ./ contrib/scripts/ast_tls_cert

[SVN commits to the Asterisk project]

Author: twilson
Date: Fri Oct 22 12:16:57 2010
New Revision: 292743

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=292743
Log:
Merged revisions 292740 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.8

........
  r292740 | twilson | 2010-10-22 09:49:34 -0700 (Fri, 22 Oct 2010) | 45 lines
  
  Add TLS cert helper script
  
  This script is useful for quickly generating self-signed CA, server, and client
  certificates for use with Asterisk. It is still recommended to obtain
  certificates from a recognized Certificate Authority and to develop an
  understanding how SSL certificates work. Real security is hard work.
  
  OPTIONS:
    -h  Show this message
    -m  Type of cert "client" or "server". Defaults to server.
    -f  Config filename (openssl config file format)
    -c  CA cert filename (creates new CA cert/key as ca.crt/ca.key if not passed)
    -k  CA key filename
    -C  Common name (cert field)
          For a server cert, this should be the same address that clients
          attempt to connect to. Usually this will be the Fully Qualified
          Domain Name, but might be the IP of the server. For a CA or client
          cert, it is merely informational. Make sure your certs have unique
          common names.
    -O  Org name (cert field)
          An informational string (company name)
    -o  Output filename base (defaults to asterisk) 
    -d  Output directory (defaults to the current directory)
  
  Example:
  
  To create a CA and a server (pbx.mycompany.com) cert with output in /tmp:
    ast_tls_cert -C pbx.mycompany.com -O "My Company" -d /tmp
  
  This will create a CA cert and key as well as asterisk.pem and the the two
  files that it is made from: asterisk.crt and asterisk.key. Copy asterisk.pem
  and ca.crt somewhere (like /etc/asterisk) and set tlscertfile=/etc/asterisk.pem
  and tlscafile=/etc/ca.crt. Since this is a self-signed key, many devices will
  require you to import the ca.crt file as a trusted cert.
  
  To create a client cert using the CA cert created by the example above:
    ast_tls_cert -m client -c /tmp/ca.crt -k /tmp/ca.key -C "Joe User" -O \
      "My Company" -d /tmp -o joe_user
  
  This will create client.crt/key/pem in /tmp. Use this if your device supports
  a client certificate. Make sure that you have the ca.crt file set up as
  a tlscafile in the necessary Asterisk configs. Make backups of all .key files
  in case you need them later.
........

Added:
    trunk/contrib/scripts/ast_tls_cert
      - copied unchanged from r292740, branches/1.8/contrib/scripts/ast_tls_cert
Modified:
    trunk/   (props changed)

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-1.8-merged' - no diff available.