AUTHOR: Calculate Ltd. <support@calculate.ru> 



INSTALL

-------



calculate-api needs the following library version installed, in order to run:

    python >= 2.6

    soaplib = 1.0

    calculate-lib >= 2.2.0.0



To install calculate-api, just execute the install script 'setup.py'.

Example:



    ./setup.py install



####################################



Create root certificate (self-signed)



$ openssl genrsa -out root.key 1024

$ openssl req -new -key root.key -out root.csr

$ openssl x509 -req -days 1096 -in root.csr -signkey root.key -out root.crt



or



$ openssl req -new -newkey rsa:1024 -nodes -keyout root.key -x509 -days 1096 

    -subj /C=RU/ST=Spb/L=Spb/O=calculate-linux\ \

    Inc/OU=Sale/CN=www.calculate-linux.ru/emailAddress=support@calculate-linux.ru 

    -out root.crt  # CN - unique name root certificate



####################################



Create server certificate



$ openssl genrsa -out server.key 1024

$ openssl req -new -key server.key -out server.csr

$ openssl x509 -req -days 365 -CA root.crt -CAkey root.key

    -CAcreateserial -in server.csr -out server.crt



e.g.

$ cd /var/calculate/server/server_certs/

$ openssl x509 -req -days 365 -CA /var/calculate/server/ca/root.crt -CAkey \

  /var/calculate/server/ca/root.key -CAcreateserial -in ./NUM.csr -out ./NUM.crt

  

NUM - number certificate



####################################



Show certificate



openssl x509 -noout -text -in certificate.crt



Show request



openssl req -noout -text -in request.csr



Show key



openssl rsa -noout -text -in key.key



Show CRL



openssl crl -text -noout -in ca.crl



####################################



Create not root ca certificate



$ openssl genrsa -out ca.key 1024

$ openssl req -new -key ca.key -out ca.csr

$ openssl x509 -req -days 365 -CA root.crt -CAkey root.key -CAcreateserial \

     -extfile ssl-server-ca.cfg -extensions ssl_server_ca -in ca.csr -out ca.crt



$ cat ssl-server-ca.cfg 



[ ssl_server_ca ]

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer:always

basicConstraints = critical,CA:true

#basicConstraints = CA:true

keyUsage = keyCertSign, digitalSignature, keyEncipherment, cRLSign

extendedKeyUsage = serverAuth



####################################



Files



/var/calculate/server - directory with clients and servers request and signed 

certificates, rights certificates (groups):

  /var/calculate/server/ca - directory with root certificates, server certificates and 

                             CA certificate.

  /var/calculate/server/client_certs - clients request and signed certificates

  /var/calculate/server/server_certs - servers request and signed certificates

  /var/calculate/server/conf/group_right.conf - list of methods available for groups

  example of content:

      manager pid_info,list_pid,cl_template,cl_login

      

  /var/calculate/server/conf/right.conf - list of number certificates who are allowed 

                                          execution of the method

  example of content:

      pid_info 2 -1

  certificate number 2 has right to run method "pid_info", and the certificate 

  number 1 does not have rights. Use key --right-add and --right-del. See man.