Chrome, certificates and missing_subjectAltNames Part 2 of 1

Actually I wanted to cover this topic in the previous post, but somehow have missed it.

Using the mentioned one liner can lead to typos and/or some strange behaviour on the CA side, especially when using a Windows-CA.

To circumvent this issues, I mentioned “a specially designed *.conf file” which I’d like to elaborate today.

Following steps are necessary:

Create a file “req.conf” in etc/ssl/ (Ubuntu 14.04, pathes may vary) with the following content:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = $YourTLD
ST = $YourState
L = $YourCity
O = $YourCompany
OU = $YourDepatment
CN = $YourCName (e.g. internal.company.tld)
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = *.internal.company.tld
DNS.2 = internal.company.tld
DNS.3 = www.*.internal.company.tld

Essentially, these are the information provided by the “-subj section” in last weeks one liner.

Now you can generate a key:

openssl genrsa -out internal.company.tld.key 4096

and use your new key and the req.conf file to generate a CSR, which, as usually can be fed into your local CA.

openssl req -new -out internal.company.tld.csr -key internal.company.de.key -config req.conf -sha256

This *.conf file can be used as a template for other C/altNames as well and is, in my eyes, more lucid than a one liner.

Tim Albert

Autor: Tim Albert

Tim kommt aus einem kleinen Ort zwischen Nürnberg und Ansbach, an der malerischen B14 gelegen. Er hat in Erlangen Lehramt und in Koblenz Informationsmanagement studiert, wobei seine Tätigkeit als Werkstudent bei IDS Scheer seinen Schwenk von Lehramt zur IT erheblich beeinflusst hat. Neben dem Studium hat Tim sich außerdem noch bei einer Werkskundendienstfirma im User-Support verdingt. Blerim und Sebastian haben ihn Anfang 2016 zu uns ins Managed Services Team geholt, wo er sich nun insbesondere um Infrastrukturthemen kümmert. In seiner Freizeit engagiert sich Tim in der Freiwilligen Feuerwehr - als Maschinist und Atemschutzgeräteträger -, spielt im Laientheater Bauernschwänke und ist auch handwerklich ein absolutes Allroundtalent. Angefangen von Mauern hochziehen bis hin zur KNX-Verkabelung ist er jederzeit einsatzbereit. Ansonsten kocht er sehr gerne – alles außer Hase!

Foreman’s 8th birthday – We will give a party

Foreman Logo

After the success last year we decided to celebrate the 8th Birthday of the Foreman Project again at event room Kesselhaus on July, 27th. As feedback was very good about the provided content we decided to provide the same schedule.

We will start right after lunch at 12:30pm with a hands-on session, so you can do your first steps with Foreman, have a look into latest development or get some inspiration which plugins to add to your environment. There will be some experienced users and developers around to help you, give you some tips for your environment or do some in-person hacking. The demos will showcase several ways of provisioning, configuration management with Puppet and Ansible, orchestration, monitoring integration and other plug-ins.

After a short coffee break we will have 3-5 talks for 30-40 minutes depending on how many speakers I can find. Already confirmed speakers are Ewoud Kohl van Wijngaarden, Michael Moll and Timo Goebel, all being long-term users and contributors to the Foreman Project. I am still looking for someone willing to talk about how he is using Foreman, so if you want to give a case study talk simply drop me a mail.

It would not be a party if we would not have at least some Pizza and Beer afterwards. And the Foreman’s Community guy Greg Sutcliffe already promised some swag to take home with you.

So if you want to join us, please register for free here. This will enable us to order enough food and drinks. We will keep you updated on twitter and on the event page. As a teaser you can watch the recording of me giving a demo at OSDC.

If you can not make it to our event, keep your eyes open for an event near you. For example Julien Pivotto already announced one in Belgium.

Dirk Götz

Autor: Dirk Götz

Dirk ist Red Hat Spezialist und arbeitet bei NETWAYS im Bereich Consulting für Icinga, Nagios, Puppet und andere Systems Management Lösungen. Früher war er bei einem Träger der gesetzlichen Rentenversicherung als Senior Administrator beschäftigt und auch für die Ausbildung der Azubis verantwortlich.

Open Source Backup Conference – Why you should submit a talk!

The call for papers for the Open Source Backup Conference from September 25 to September 26 is still running until June 30.

Interested Speakers are invited to submit their presentation proposals via the call for papers form ob osbconf.org.

What kind of talks are we searching for?
Case Studies, Best Practices, Experience Reports as well as latest developments on open source backup solutions

What affects our decision for a talk?
It should bring a real benefit for the attendees, it should not be a promotion lecture

What awaits you in Cologne?
Two days full of open source backup solutions, meeting the open source community and spreading your know how to the other attendees!

We would be pleased to get your proposals until June 30!

You’d rather join the OSBConf as an attendee? Get your tickets now!

Julia Hackbarth

Autor: Julia Hackbarth

Julia ist seit 2015 bei NETWAYS. Sie hat im September ihre Ausbildung zur Kauffrau für Büromanagement gestartet. Etwas zu organisieren macht ihr großen Spaß und sie freut sich auf vielseitige Herausforderungen. In ihrer Freizeit spielt Handball eine große Rolle: Julia steht selbst aktiv auf dem Feld, übernimmt aber auch gerne den Part als Schiedsrichterin.

Chrome, certificates and missing_subjectAltNames

Google has been actively trying to ensure certificate security especially in the last months.

Sometimes this created quite some buzz in the IT World, e.g. when Symantecs policies came into the focus.

Current version 58 of Google Chrome has again adjusted the certificate policy.

Certificates provide two ways to store hostnames: CommonName and SubjectAltName (SAN). RFC 2818 specified in 2000 that CommonName should be deprecated, which Chrome now complies to.

Other browsers are currently still accepting the CommonName, which is mostly used by selfsigned certificates, as in our case :/

Users who wanted to access our internal sites encountered error messages and were forced to use quick and dirty workarounds, such as using a Windows registry “hack”:

Open a cmd-Shell as Administrator and enter:

reg add \HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome /v EnableCommonNameFallbackForLocalAnchors /t REG_DWORD /d 1 /f

which reactivates the fallback to CommonName

As this is just a temporary “solution”, you should issue an RFC 2818 conform certificate. This can be realized by using a complete and compliant certificate signing request (CSR).

You can either use a specially designed *.conf File for this or simply adapt the following shell command:

openssl req -new-key endpoint.com.key -sha256 -nodes  -subj '/C=US/ST=New York/L=New York/O=End Point/OU=Hosting Team/CN=www.endpoint.com/
         emailAddress=administrative-not-existent-address@our-awesome-domain.com/
         subjectAltName=DNS.1=endpoint.com,
         DNS.2=usually-not-convered-domain.endpoint.com,
         DNS.3=multiple-domains-crt.endpoint.com' > www.endpoint.com.csr
The created csr can be fed e.g. into your local CA to issue new certificates which can be rolled out in your environment.
Live long and prosper and be RFC compliant 🙂
Tim Albert

Autor: Tim Albert

Tim kommt aus einem kleinen Ort zwischen Nürnberg und Ansbach, an der malerischen B14 gelegen. Er hat in Erlangen Lehramt und in Koblenz Informationsmanagement studiert, wobei seine Tätigkeit als Werkstudent bei IDS Scheer seinen Schwenk von Lehramt zur IT erheblich beeinflusst hat. Neben dem Studium hat Tim sich außerdem noch bei einer Werkskundendienstfirma im User-Support verdingt. Blerim und Sebastian haben ihn Anfang 2016 zu uns ins Managed Services Team geholt, wo er sich nun insbesondere um Infrastrukturthemen kümmert. In seiner Freizeit engagiert sich Tim in der Freiwilligen Feuerwehr - als Maschinist und Atemschutzgeräteträger -, spielt im Laientheater Bauernschwänke und ist auch handwerklich ein absolutes Allroundtalent. Angefangen von Mauern hochziehen bis hin zur KNX-Verkabelung ist er jederzeit einsatzbereit. Ansonsten kocht er sehr gerne – alles außer Hase!

OSDC 2017 – What a great week full of open source!

Over the weekend, we caught up on missed sleep and we were really happy about the successful Open Source Data Center Conference last week in Berlin.

The OSDC 2017 began with our workshop day on Tuesday with „Graylog-Centralized Log Management“, „Mesos Marathon – Orchestrating Docker Containers“ and „Terraform – Infrastructure as Code“.

On Wednesday and Thursday attendees could join 23 interesting talks on case studies, the latest developments and best practices. CONTAINERS AND MICROSERVICES | CONFIGURATION MANAGEMENT | TESTING, METICS AND ANALYSIS and TOOLS&INFRASTRUCTURE were forming the core of the conference! Details about the talks, you can get in Michi’s and Dirk’s Blogposts.

On Wednesday evening, we went to the Umspannwerk Ost. There was much sun, and so we could all sit outside and discuss the exciting days. Furthermore, it was enough time for networking, establishing contacts and becoming more familiar with the open source community!

After the conference was gone on Thursday, we were happy to meet you all in Berlin and also a little bit sad, because three exciting conference days came to an end.

At this point, it is time to say a cordial THANK YOU!

Thanks to our speakers who made us laugh and who gave us so much knowledge!
Thanks to our sponsors for the wonderful support and your confidence!
Thanks to our attendees for making the OSDC unique!

We’ll hope to see you all next year! The date for 2018 is already fixed.

The pictures, slides and videos of the OSDC will be available soon!

OSDC 2018 | June 14 – 16, 2018 | Berlin

Julia Hackbarth

Autor: Julia Hackbarth

Julia ist seit 2015 bei NETWAYS. Sie hat im September ihre Ausbildung zur Kauffrau für Büromanagement gestartet. Etwas zu organisieren macht ihr großen Spaß und sie freut sich auf vielseitige Herausforderungen. In ihrer Freizeit spielt Handball eine große Rolle: Julia steht selbst aktiv auf dem Feld, übernimmt aber auch gerne den Part als Schiedsrichterin.

OSDC 2017 – How it went on!

After the talks on Wednesday were finished, two OSDC-VIP buses stood in front of the MOA Hotel. After all attendees found their seats, we drove threw the whole city and finally reached the Umspannwerk Ost.

Bright Sunshine, perfect. As in the last year, there was a huge variety of culinary delights. Due to the bright sunshine till the evening hours, most of us sat outside the listed building, which is the oldest substation in Berlin. With some soft drinks and yummy food (look at the pictures), the evening ran its course.

As a little surprise for the attendees, we organised a kicker. Not a standard kicker, but a kicker for more than four persons. It was really funny!
And so the hours passed until the third shuttle VIP-Bus brought all of us back to the conference hotel. After a very short night, the talks for today started on time. What the talks are about, you can find out in Michi’s Blogpost after the conference has been finished.

For our events team, it’s now the final spurt, before the post processing may start tomorrow. We hope, all attendees have an interesting second conference day and a save journey home!

SAVE THE DATE FOR 2018 | June 12-14

 

This slideshow requires JavaScript.

Julia Hackbarth

Autor: Julia Hackbarth

Julia ist seit 2015 bei NETWAYS. Sie hat im September ihre Ausbildung zur Kauffrau für Büromanagement gestartet. Etwas zu organisieren macht ihr großen Spaß und sie freut sich auf vielseitige Herausforderungen. In ihrer Freizeit spielt Handball eine große Rolle: Julia steht selbst aktiv auf dem Feld, übernimmt aber auch gerne den Part als Schiedsrichterin.