Exit Zen
28
string ID 128
type: paragraph
English
Installing an untrusted, self-issued, or self-signed CA certificate poses a
75/750 · 75
29
string ID 137
type: heading
English
Diffie-Hellman (DH) Parameters
30/300 · 30
30
string ID 139
type: paragraph
English
Diffie-Hellman (DH) key exchange is a cryptographic protocol that allows two parties to securely establish a shared secret over an insecure communication channel. The key exchange process involves both parties agreeing on a set of parameters, known as Diffie-Hellman parameters, which include a large prime number `p` and a generator `g`. Since generating these parameters is a computationally expensive task, a user might prefer to provide a precomputed value at startup.
472/4720 · 472
31
string ID 147
type: paragraph
English
The following Boost.Asio methods can be used for loading DH parameters:
71/710 · 71
32
string ID 149
type: list
English
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh.html `net::ssl::context::use_tmp_dh`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh_file.html `net::ssl::context::use_tmp_dh_file`]
215/2150 · 215
33
string ID 152
type: paragraph
English
If no DH parameter is provided, OpenSSL will refuse to perform any handshake that uses DHE-based cipher suites but will still work with other cipher suites, such as those based on ECDHE.
186/1860 · 186
34
string ID 158
type: heading
English
A Self-Issued Certificate Example
33/330 · 33
35
string ID 160
type: paragraph
English
In the following example, we will generate a self-signed CA certificate and use it to issue both server and client certificates.
128/1280 · 128
36
string ID 163
type: list
English
* Generate a CA certificate:
28/280 · 28
37
string ID 165
type: paragraph
English
``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "/CN=localhost" -days 365 ```
106/1060 · 106
38
string ID 170
type: list
English
* Generate a Server CSR:
24/240 · 24
39
string ID 172
type: paragraph
English
``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" ```
150/1500 · 150
40
string ID 177
type: list
English
* Sign the Server CSR using our CA:
35/350 · 35
41
string ID 179
type: paragraph
English
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
113/1130 · 113
42
string ID 184
type: list
English
* Generate a Client CSR:
24/240 · 24
43
string ID 186
type: paragraph
English
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
97/970 · 97
44
string ID 191
type: list
English
* Sign the Client CSR using our CA:
35/350 · 35
45
string ID 193
type: paragraph
English
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
91/910 · 91
46
string ID 197
type: list
English
* Generate a DH parameters file:
32/320 · 32
47
string ID 199
type: paragraph
English
``` openssl dhparam -out dh4096.pem 4096 ```
44/440 · 44