****** Configuring the RPKI CA tools ****** This section describes the configuration file syntax and settings. Each of the programs that make up the RPKI tookit can potentially take its own configuration file, but for most uses this is unnecessarily complicated. The recommended approach is to use a single configuration file, and to put all of the parameters that a normal user might need to change into a single section of that configuration file, then reference these common settings from the program- specific sections of the configuration file via macro expansion. The configuration file parser supports a limited version of the macro facility used in OpenSSL's configuration parser. An expression such as foo = ${bar::baz} sets foo to the value of the baz variable from section bar. The section name ENV is special: it refers to environment variables. ***** rpki.conf ***** The default name for the shared configuration file is rpki.conf. The location of the system-wide rpki.conf file is selected by ./configure during installation; the default location is /usr/local/etc, unless you use the -- sysconfdir option to ./configure, in which case the default location is whatever directory you gave ./configure as the argument to this option. You can override the build-time default filename at runtime by setting the RPKI_CONF environment variable to the name of the configuration file you want to use. Most of the programs also take a command-line option specifying the name of the configuration file; if both the command line option and the environment variable are set, the command line option wins. Unless you really know what you're doing, you should start by copying the rpki.conf from the rpkid/examples directory and modifying it, as the sample configuration file already includes all the additional settings necessary to use the simplified configuration. We really should have a configuration wizard script which leads you through the process of creating a basic rpki.conf file, but we haven't written it yet. Someday Real Soon Now. [myrpki] The [myrpki] section of rpki.conf contains all the parameters that you really need to configure. The name myrpki] is historical and may change in the future. # Handle naming hosted resource-holding entity () represented # by this myrpki instance. Syntax is an identifier (ASCII letters, # digits, hyphen, underscore -- no whitespace, non-ASCII characters, # or other punctuation). You need to set this. handle = Me Every resource-holding or server-operating entity needs a "handle", which is just an identifier by which the entity calls itself. Handles do not need to be globally unique, but should be chosen with an eye towards debugging operational problems: it's best if you use a handle that your parents and children will recognize as being you. Previous versions of the CA tools required a separate configuration file, each with its own handle setting, for each hosted entity. The current code allows the current handle to be selected at runtime in both the GUI and command line user interface tools, so the handle setting here is just the default when you don't set one explictly. # Directory for BPKI files generated by rpkic and used by rpkid and pubd. # Default is where we expect autoconf to decide that our data files # belong, you might want or need to change this. In the long term # this should be handled by a setup wizard. bpki_servers_directory = /usr/local/share/rpki You shouldn't need to change this unless you used the --datarootdir option to tell ./configure; if you did, you'll need to adjust the setting of bpki_servers_directory to match whatever you told ./configure. # Whether you want to run your own copy of rpkid (and irdbd). You # want this on unless somebody else is hosting rpkid service for you. run_rpkid = true You probably don't need to change this. # DNS hostname and server port numbers for rpkid and irdbd. rpkid's # server host has to be a publicly reachable name to be useful; # irdbd's server host should always be localhost unless you really # know what you are doing. Port numbers can be any legal TCP port # number that you're not using for something else. rpkid_server_host = rpkid.example.org rpkid_server_port = 4404 irdbd_server_host = localhost irdbd_server_port = 4403 You'll need to set at least the rpkid_server_host parameter here. You may be able to use the default port numbers, or may need to pick different ones. Unless you plan to run irdbd on a different machine from rpkid, you should leave irdbd_server_host alone. # Whether you want to run your own copy of pubd. In general, it's # best to use your parent's pubd if you can, to reduce the overall # number of publication sites that relying parties need to check, so # don't enable this unless you have a good reason. run_pubd = false # DNS hostname and server port number for pubd, if you're running it. # Hostname has to be a publicly reachable name to be useful, port can # be any legal TCP port number that you're not using for something # else. pubd_server_host = pubd.example.org pubd_server_port = 4402 # Contact information to include in offers of repository service. # This only matters when we're running pubd. This should be a human # readable string, perhaps containing an email address or URL. pubd_contact_info = repo-man@rpki.example.org The out of band setup protocol will attempt to negotiate publication service for you with whatever publication service your parent is using, if you let it, so in most cases you should not need to run pubd unless you need to issue certificates for private IP address space or private Autononmous System Numbers. If you do run pubd, you will need to set pubd_server_host. You may also need to set pubd_server_port, and you should provide something helpful as contact information in pubd_contact_info if you plan to offer publication service to your RPKI children, so that grandchildren (or descendents even further down the tree) who receive referrals to your service will know how to contact you. # Whether you want to run your very own copy of rootd. Don't enable # this unless you really know what you're doing. run_rootd = false # Server port number for rootd, if you're running it. This can be any # legal TCP port number that you're not using for something else. rootd_server_port = 4401 You shouldn't run rootd unless you're the root of an RPKI tree. Who gets to be the root of the public RPKI tree is a political issue outside the scope of this document. For everybo
#!/bin/sh

# For a list of supported curves, use "apps/openssl ecparam -list_curves".

# Path to the openssl distribution
OPENSSL_DIR=../..
# Path to the openssl program
OPENSSL_CMD=$OPENSSL_DIR/apps/openssl
# Option to find configuration file
OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf"
# Directory where certificates are stored
CERTS_DIR=./Certs
# Directory where private key files are stored
KEYS_DIR=$CERTS_DIR
# Directory where combo files (containing a certificate and corresponding
# private key together) are stored
COMBO_DIR=$CERTS_DIR
# cat command
CAT=/bin/cat
# rm command
RM=/bin/rm
# mkdir command
MKDIR=/bin/mkdir
# The certificate will expire these many days after the issue date.
DAYS=1500
TEST_CA_FILE=rsa1024TestCA

TEST_SERVER_CURVE=sect163r1
TEST_SERVER_FILE=sect163r1-rsaTestServer
TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (sect163r1 key signed with RSA)"

TEST_CLIENT_CURVE=sect163r1
TEST_CLIENT_FILE=sect163r1-rsaTestClient
TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (sect163r1 key signed with RSA)"

# Generating an EC certificate involves the following main steps
# 1. Generating curve parameters (if needed)
# 2. Generating a certificate request
# 3. Signing the certificate request 
# 4. [Optional] One can combine the cert and private key into a single
#    file and also delete the certificate request

$MKDIR -p $CERTS_DIR
$MKDIR -p $KEYS_DIR
$MKDIR -p $COMBO_DIR

echo "GENERATING A TEST SERVER CERTIFICATE (ECC key signed with RSA)"
echo "=============================================================="
$OPENSSL_CMD ecparam -name $TEST_SERVER_CURVE -out $TEST_SERVER_CURVE.pem

$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \
    -keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \
    -newkey ec:$TEST_SERVER_CURVE.pem -new \
    -out $CERTS_DIR/$TEST_SERVER_FILE.req.pem

$OPENSSL_CMD x509 -req -days $DAYS \
    -in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \
    -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
    -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
    -out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial

# Display the certificate 
$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text

# Place the certificate and key in a common file
$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \
	 > $COMBO_DIR/$TEST_SERVER_FILE.pem
$CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem

# Remove the cert request file (no longer needed)
$RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem

echo "GENERATING A TEST CLIENT CERTIFICATE (ECC key signed with RSA)"
echo "=============================================================="
$OPENSSL_CMD ecparam -name $TEST_CLIENT_CURVE -out $TEST_CLIENT_CURVE.pem

$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \
	     -keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \
	     -newkey ec:$TEST_CLIENT_CURVE.pem -new \
	     -out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem

$OPENSSL_CMD x509 -req -days $DAYS \
    -in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \
    -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
    -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
    -out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial

# Display the certificate 
$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text

# Place the certificate and key in a common file
$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \
	 > $COMBO_DIR/$TEST_CLIENT_FILE.pem
$CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem

# Remove the cert request file (no longer needed)
$RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-26 18:41:07 +0000