How to set up a CA with CRL for its certificates on Mac OS X
How to create Revoked certificates with CRLs on Mac OS X
1) Create a directory somewhere on your mac where you can find it.
Let’s call it directcerts:
mkdir directcerts
Now protect that directory so only the user you are running as (and root) can access it:
chmod 0700 sslcert
Cd into the first directory and make two subdirectories. Let’s call them certs and private.
cd directcerts
mkdir certs private
3) Create a database to keep track of each certificate signed
Type:
echo ‘100001’ >serial
touch index.txt
Note: The database ID MUST have an even number of digits. Don’t ask me why.
4) Modify the config file for openssl to use
This is probably the hardest part. First, navigate to /System/Library/OpenSSL in either Finder or Terminal. Copy the openssl.cnf file and rename it something like openssl_original.cnf. We want to do this because we want to be able to back up to the original if something gets borked.
Open openssl.cnf using a text editor like vim (I wasn’t able to use a GUI based editor because I couldn’t get the root access that I needed to write to the file). You will need to use the sudo command to open it and save any edits because the owner is the root user.
sudo vim openssl.cnf
(read up on vim online to figure out how to make edits to the file if you need to).
The first change is the directory (dir). I am not sure if this is necessary, but it seems to make sense given that we could be working in any directory. Next, comment out the crlnumber line in the CA_default section with the pound sign. Then, update the req_distinguished_name section to include any default values to make creating certificate requests easier (helpful if you need to create a lot of certificate requests).
Scroll down to the usr_cert section of the configuration file. Add a new line for crlDistributionPoints that looks like the following example:
crlDistributionPoints =URI:http://lol.com/crl.crl
What you have just done is add an extension that will be added to a new certificate when that certificate is created (but only if you tell it to use that extension when you create it… will explain this later).
As an example, see how the “dir” line has been updated:
# # OpenSSL configuration file. # # Establish working directory. [ ca ] default_ca = CA_default [ CA_default ]
dir = . serial = $dir/serial database = $dir/certindex.txt new_certs_dir = $dir/certs certificate = $dir/cacert.pem private_key = $dir/private/cakey.pem default_days = 365 default_md = md5 preserve = no email_in_dn = no nameopt = default_ca certopt = default_ca policy = policy_match
All other certificates you create will be based off of the root certificate that you are about to create. Because you are not a commercial certificate authority, software may complain when they use your certificates. However you can give people one of the files, the “public” one, that will be created and they can manually import it. From then on your certificates will load just like the commercial ones.
To create, while in the ‘directcerts’ directory, type:
openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365
Note the -days 365 option. For a root certificate you may want it to last longer than one year so that you do not have to reissue it so often.
OpenSSL will ask you for a passphrase. Enter one and remember it because we’ll need it when we are creating the user certificates and certificate requests.
6) Create certificate requests for new certificates
OpenSSL uses the concept of creating certificate requests which are not real certificates in order to create real certificates. I know that sounds weird, but I think the logic and the workflow make sense when you think about it. Step 1, create the CA, step 2, create a certificate request from the CA. Step 3, have the CA sign the certificate request and create the certificate.
So, while still in the directcerts directory, use the following command to create a new certificate requests
openssl req -new -nodes -out certificate_request_name.pem -keyout private/certificate_request_key_name.pem -days 365
Fill in the details of the DN (btw, the organizationName field must match the organizationName of the CA in order for you to create a request from the CA) and the email address associated with the certificate. You will notice that once you’ve finished this, the directcerts directory will have the key file (which will be the actual certificate private key) in the “private” directory and the request will be in the directcerts directory.
7) Sign the certificate requests to create a new certificate
The next step creates our certificate, but here we’ll want to be sure to include the optional extensions that will inclue the CRL information in our certificate. Use the following command while in the same directory:
openssl ca -out name_of_certificate.pem -days 365 -extensions usr_cert -infiles certificate_request_name.pem
This will hopefully create the actual certificate in the directcerts directory as well as a copy of it, using the index id for the CRL list, in the “certs” subdirectory.
8) Create the CRL
Use this command to create the CRL file.
openssl ca -gencrl -keyfile private/cakey.pem -cert cacert.pem -out my_crl.pem
9) Revoke a certificate
If you would like to revoke a certificate, it’s fairly easy. Just tell openssl to revoke a certificate using the name of the certificate and give openssl your CA information.
openssl ca -revoke cert_to_revoke.pem -keyfile private/cakey.pem -cert cacert.pem
10) Update your CRL file to include the new revocation information
openssl ca -gencrl -keyfile private/cakey.pem -cert cacert.pem -out my_crl.pem
11) Publish your CRL
Post your CRL in the location that you specified in the openssl.cnf file so that other computers can look up the revocation information.
Nike vs. Aetna
So, I got two emails today. Ok, yes, I got a few more than two, but I want to explain two in particular. One was a promotion from Nike about some new cool fit clothes. I had to adjust my email to make sure I could see the images, because you know, Nike doesn’t send text emails, it’s almost all images.
The other email was from Aetna and it talked about a new thing that they’ve added to their website that allows you to do some checking of medical costs prior to showing up at the provider. They gave the example of some places charging more than $1000 more for an MRI than another place for the same MRI. Now, I work in healthcare and in IT, so this app is right in my wheelhouse. I’m all about trying to save money in healthcare and encouraging patients to be aware of costs and trying to keep that down is a great idea!
However, I didn’t click on anything in the Aetna email, but I did click on the link to the new golf line in the nike email. What does that say? My initial thoughts are that it says that I’m more interested in something short term that can make me happy. Trying to save my health insurer some money is just a way far off goal and I doubt I’ll ever use that service that they just emailed me about.
Somehow Aetna needs to incentivize people to use something like that… Ideas:
1) Use more images and use better images. Don’t use a little picture of a mason jar of pennies to incentivize me to read your email.
2) Make the message short and to the point and use large font - don’t use small font and give me 3 paragraphs that I have to read to figure out what the message is your trying to get across.
3) Your video (quicktime) is actually pretty cool, but don’t make me download a WMV file! Use Youtube so it’s easier to watch. I had to wait a few minutes for the video to download, and I had to be sure that I had a WMV converter.
4) You need to make me want to use your service beyond some weird statement like, “you could possibly save hundreds or even thousands of dollars in your healthcare costs - just by your selection of providers?”. What does that even mean? If you mean save you money, why should I care? Sell it honestly—that you want the providers to lower their costs and that way we as a country won’t be so in debt because we’re beholden to the provider’s being able to set the costs to whatever they want. I know that’s kind of a lot to try to say, but at the end of the day, don’t try to trick us into using the service, give us an honest answer. You’d be surprised at how much people value honesty and will rally behind a big cause, which I think is what we have on our hands.
Appifying Healthcare
Angie, my wife, is almost 9 months pregnant. At one of our early visits with the OBGYN, he told Angie to checkout babycenter.com. We did so and have been learning a TON from that site. She even learned from reading one of the weekly emails that she suffers from “Restless Leg Syndrome” and should stay away from anti-hystemines as those tend to exacerbate the problem (which would explain why when she’s tried Tylenol PM in the past, it’s only made her symptoms worse).
In England, some doctors are going to “prescribe” apps for patients to help them deal with health issues.
This relates to an interesting tweet today from someone attending a conference at South By Southwest: “Health happens between doctor visits: ‘The avg 24 y/o will spend more time on fb this week than he will spend w/his Dr in 20 yrs” #SXSWh”.
That statement makes it pretty clear that even though their seems to be a sea change in healthcare right now, there are probably a lot of people who either: 1) Don’t have doctors that are all that IT savvy and aren’t pointing them to some helpful resources, or 2) aren’t going to the doctor very frequently.
Which leaves those gaps to be filled by the rest of us. So take some time today to tweet or post something to facebook that encourages your friends and followers to do something healthy. Post that you went for a run. Or that you want to have your friends keep you accountable for reaching a particular health goal. This might motivate your friends in turn. Alternatively, post an article about healthy foods or a cool website or health app that you’ve found.
Let’s not all point fingers at other people such as doctors or the government and try to fill those gaps.
Response to Mr. Crouch
Just read this post by Andy Crouch in the Wall Street Journal and wanted to record some initial reactions.
1) It seems somewhat odd and even distasteful that a Christian would take this opportunity to underscore the fact that all the hype over Steve Jobs is overblown because he never confessed Jesus as Lord publicly. Crouch is obviously an outspoken type of individual, so I suppose we should take that into consideration and forgive him as we would want to be forgiven.
2) I think that Mr. Crouch would do well to look at Jobs’ Stanford address in light of how Jesus acted, spoke, and behaved. Did Jesus live how others would want him to live? No, he didn’t. He lived as God the Father told him and he was one with the Father, not conforming to the world… I could go on, but I think you see the point. Mr. Crouch assumes the worst from that Stanford Commencement statement. It appears he would like to read something to the tune of “Don’t follow God, or Jesus, or the Church, but do whatever you want.” I’m not sure that’s what Steve is saying. After reading some of his articles and seeing a few of his videos, I don’t see that type of dismissiveness of people’s deep beliefs. I guess what I’m saying is that I don’t see Steve saying “Oh, you have a faith in something beyond humanity? How stupid!”.
3) As a believer in God, I can’t say that I wouldn’t want Steve to have known the Lord, so the quote from Dr. King is obviously taken as a beautiful quote coming from a man of great faith in God. I get the sense, however, that this quote wasn’t chosen just to highlight that Steve didn’t claim to be a Christian, but that Steve was working too hard for himself. The quote has a very passive tone, which is important as a Christian—we should definitely submit to God’s will. But isn’t it part of God’s will that we serve others? And isn’t serving active in nature? Certainly, Dr. King would not disagree with that.
The fact that Steve did so much for the world by creating wonderfully designed products is in some ways serving people is it not? For they allow people to get things done better, faster, and maybe even allow them to have fun as they do it. Further, consider the number of jobs that Apple has created (probably in the thousands at this point?) the wealth generation, and the pride in work that it produced in Apple’s employees. Certainly being CEO of Apple was not always easy and far too often we want to portray CEOs as greedy people and the farthest things from servants. I’m not sure I see Steve as that type of CEO… Taking the salary of $1 is a way to at least say that he didn’t want to be perceived as greedy and working only for the money.
Some would argue perhaps that Steve wasn’t really that involved in the creation of the products themselves and that it was the employees who were the main driver behind Apple’s products. I don’t entirely hold to that view and would encourage that person to read a few articles about Jobs (including this one). What I’m saying is that I think someone with his vision, passion, dedication, and pursuit of perfection can and should be construed as a potential Christian attitude as long as it’s couched in love. But perhaps I was reading too much into the quote…
4) I think what irks me the most about this article is how different this would have been had Steve claimed he was a Christian. Oh, what a champion he would have been to Mr. Crouch then… Because Mr. Crouch obviously knows all men’s hearts and can separate the sheep from the goats. That and the fact that I think Steve’s overall servant mentality was not adequately addressed by a Christian such as Mr. Crouch.
5) Finally, about “technology’s promise [to] take us to the promised land.”. Steve didn’t seem to endorse only a hope in technology. This quote is from his 1996 interview with Wired Magazine:
Interviewer: Could technology help by improving education?
Steve Jobs: I used to think that technology could help education. I’ve probably spearheaded giving away more computer equipment to schools than anybody else on the planet. But I’ve had to come to the inevitable conclusion that the problem is not one that technology can hope to solve. What’s wrong with education cannot be fixed with technology. No amount of technology will make a dent.
It’s a political problem. The problems are sociopolitical. The problems are unions. You plot the growth of the NEA [National Education Association] and the dropping of SAT scores, and they’re inversely proportional. The problems are unions in the schools. The problem is bureaucracy. I’m one of these people who believes the best thing we could ever do is go to the full voucher system.
I have a 17-year-old daughter who went to a private school for a few years before high school. This private school is the best school I’ve seen in my life. It was judged one of the 100 best schools in America. It was phenomenal. The tuition was $5,500 a year, which is a lot of money for most parents. But the teachers were paid less than public school teachers - so it’s not about money at the teacher level. I asked the state treasurer that year what California pays on average to send kids to school, and I believe it was $4,400. While there are not many parents who could come up with $5,500 a year, there are many who could come up with $1,000 a year.
If we gave vouchers to parents for $4,400 a year, schools would be starting right and left. People would get out of college and say, “Let’s start a school.” You could have a track at Stanford within the MBA program on how to be the businessperson of a school. And that MBA would get together with somebody else, and they’d start schools. And you’d have these young, idealistic people starting schools, working for pennies.
They’d do it because they’d be able to set the curriculum. When you have kids you think, What exactly do I want them to learn? Most of the stuff they study in school is completely useless. But some incredibly valuable things you don’t learn until you’re older - yet you could learn them when you’re younger. And you start to think, What would I do if I set a curriculum for a school?
God, how exciting that could be! But you can’t do it today. You’d be crazy to work in a school today. You don’t get to do what you want. You don’t get to pick your books, your curriculum. You get to teach one narrow specialization. Who would ever want to do that?
These are the solutions to our problems in education. Unfortunately, technology isn’t it. You’re not going to solve the problems by putting all knowledge onto CD-ROMs. We can put a Web site in every school - none of this is bad. It’s bad only if it lulls us into thinking we’re doing something to solve the problem with education.
Lincoln did not have a Web site at the log cabin where his parents home-schooled him, and he turned out pretty interesting. Historical precedent shows that we can turn out amazing human beings without technology. Precedent also shows that we can turn out very uninteresting human beings with technology.
It’s not as simple as you think when you’re in your 20s - that technology’s going to change the world. In some ways it will, in some ways it won’t.
Steve Jobs
“Creativity is just connecting things. When you ask creative people how they did something, they feel a little guilty because they didn’t really do it, they just saw something. It seemed obvious to them after a while. That’s because they were able to connect experiences they’ve had and synthesize new things. And the reason they were able to do that was that they’ve had more experiences or they have thought more about their experiences than other people.
“Unfortunately, that’s too rare a commodity. A lot of people in our industry haven’t had very diverse experiences. So they don’t have enough dots to connect, and they end up with very linear solutions without a broad perspective on the problem. The broader one’s understanding of the human experience, the better design we will have. [Wired, February 1996]
El Patio
Today, Angie and I made a trip to El Patio cafe in Rockville, MD. The original impetus for this trip was to get some alfajore cookies that Angie got hooked on via an Argentinian work colleague. The trip itself went fairly well and the restaurant was interesting enough that I thought I would write a little review of it.
Part of this review is inspired by James May and Oz Clark’s wine adventure series. Both of these men are talented wordsmiths which probably stems from their prolific writing. Hence the reason for this post. I would like to be a good wordsmith as well.
Anyway, how was the restaurant? It was great! A lot of fun and pretty good food. Angie ordered a tortilla espanola with a side of Insalata Rusa. I ordered the Pollo a la Parilla (Grilled Chicken) with Fries and a tomato and onion salad. The Insalata Rusa is a chilled potato based salad with mayo and green peas stuck in it. It was delicious and refreshing after a long drive over to Rockville. The Chicken was well done and tender and was much improved after I added some chimichurri sauce to it. The tortilla espanola was amazing… Amazing. Somehow it was both crispy and chewy at the same time. The olive oil used must have been more top shelf than I’m used to and that really took the dish to the next level.
I also ordered a glass of the house Malbec. This wine tasted of a wood, vinegar, and grape leaves. It was not something I’m going to try to order again anytime soon. I did find however that taking slower sips, allowing the oxygen to interact with the old wine, allowed the wine to be a bit softer and more palatable. Is that normal? I’ll have to try the technique with other wines to find out.
The place has a small store in the back corner where they sell Argentine things like Mate, Alfajores, and Maradona look-a-likes. Just kidding about the last one. I also noticed that their pastries up at the bar looked pretty good and freshly made on premise. A reason to go back…
aw man, I hate work!
All work and no play makes Jack a dull boy.
Sure, that’s true.
Anyway, I’m writing today because I have to say that filling the void—that internal thing that tells you that you need to “do” something all of the time, be it listen to music, buy music, watch tv, read the news, read Facebook, (i’m mentioning all of the things that are more right brainy to make you think that I don’t consider those things “work” BUT I do) makes a lot of sense from a godly perspective.
You see, God would like us to work. He’s instilled in us a desire to work hard, to produce things, to fill our lives with striving and producing so that we can feel like we’ve accomplished something.
What we don’t always realize is that this is actually true. What we tell ourselves instead is that we don’t want to “work”, we want to just play. But as we just discovered, if we’re only playing, we won’t be fully fulfilled. So it’s better to just own up to it, pick something fun that you like to “do”, call it work, and do it most of the time. And do it really well. You’ll be happier for it, and the world will be better off (given that it’s a helpful activity).
Smarts and gettin’ things done
I’ve been reading through a book written by Joel Spolsky, a renowned Software Development guru that’s been working in the software space since either the 80s or 90s. A great guy—went to Yale, studied CS there, worked at Juno and Microsoft (was the program manager for MS Excel 5.0), founded different companies, and perhaps most famously, created a blog called www.joelonsoftware.com. That blog became really famous to people working in the software development space in the late 90s and early 2000s.
Anyway, one of his posts was about knowing who to hire if you are a software company. Basically, how does one choose who to hire and who not to hire. Well, Joel’s take is to ask open ended questions, have them do example code, and then determine two things: Are they “smart” and do they “get things done”. Well, this was enlightening to me for several reasons.
One, I don’t know if I ever thought of doing my work with those to criteria in mind. I guess I’ve sort of approached work as being smart, yes, getting things done, yes, but also being an all around nice guy. But Joel specifically says, you do not want to make a judgment on a candidate around the notion that you think the candidate would be a good companion on a plane trip. You need to determine two things: smart, get things done.
The second reason is because I’m not sure it’s a fully baked solution.
That being said, in the past week or so, I’ve tried Spolsky’s approach at work. I’ve noticed myself being a bit more confident (of all things) because I’m not trying to be “nice” all of the time. This is both good and bad.
Let’s break this down a bit. Spokane doesnt define the term but I think it means someone who can break down a problem and see potential (and ulitmately useful) solutions. It also connotes knowledge.
Getting things done is fairly self explanatory and I think we all recognize within reason that this is a good thing. Proverbs refers to hard workers as the “righteous”, the “just”, and “wise”. Solomon calls the lazy person “stupid”. But could it also be used as an excuse to cut people down, hurt people’s feelings, and even to break rules? I’ve heard that Steve Jobs could fit this description. [see http://m.bgr.com/2011/05/09/inside-apple-gives-rare-glimpse-into-steve-jobs-personality-apple-secrets/ and the “management style” section of his Wikipedia page.]
Upon reflection, I think that love needs to be added to these two things. Jesus preaches to love others as we would want to be loved, and to Love God with all our hearts, souls, mind and strength. We also need to leave room for the Holy Spirit. We need to pray that the Holy Spirit, who spake through the prophets, might come into us and give us the words to say and inspire action.
Another reason to add love is because someone who doesn’t have love, empathy, or a sacrificial attitude, won’t be a good candidate for you because they may not end up getting a lot done. Maybe Joel inferred this in his original statement, but a candidate without love will only be focused on their own gain. They may even not be very happy or content. If you don’t have love, you’re not fully human and you are likely a very unhappy person. It can be hard to “get things done” when you are unhappy and unfulfilled.
So some questions and a prayer to wrap this up. 1) How do we look for this attitude in a candidate? 2) Is this a valid search criteria for a candidate? Let’s pray that all of us might be smart, get things done, but also love all people and love God. Amen.
What I am learning today
What I am learning today:
To take each day at a time and to pray.
There was a time when I would be very concerned about the next day and what people thought of me and how my wife thought of me, my friends, family, folks on the street, pretty much everyone. I suppose I still do to some extent, but I think I’m doing better.
By better I mean that 1) I don’t think I’m as concerned about what others think, and 2) I don’t think I think too far into the future.
I feel like I’ve done better with taking each day at a time. I mean, even thinking about these things is kind of too much for me.
So why am I writing this? 1) Because two people, who I deeply respect, told me to write more. 2) Because I just had dinner with a friend who told me that he’s been a little anxious because he has some relational strife between he and his girlfriend. I guess I’ve been less stressed out because of the following:
- Less anxiety about the house. Angie and I have some other things that have taken our attention from “HOUSE HOUSE HOUSE FIX FIX FIX” to “Oh that… yea, it’s fine, we’ll get to it when we can. Add it to the list of things to do.”
- Job. It’s a job that’s more vertical than I’ve had in a while. That is to say that I’m working in a sector where I am gaining knowledge that can be used in a
- Love - My main mantra has been to love God with all my heart soul mind and strength… and Jesus says to take one day at a time (see Matthew 6 for more info).
For some reason those last two seem to go hand in hand. Not sure why and perhaps I’ll review this again tomorrow or sometime in the future. But for now, I’m not going to worry about that, but I’m probably going to hit the sack and talk with you all tomorrow.
What I am learning right now
What am I learning now
Could of things:
1) Scenarios are important: So I do a lot of work in a space where I don’t actually touch the end users. I don’t see them, know them, and I don’t even hardly know the people that are supposed to know them. I work in a vacuum.
Which means, that I will have to fix that. But how? I will likely need to talk to my boss or ask a question—such as: where are our use cases? I mean, I can’t even explain what I do because I don’t know what the end goal is. Do you think that’s going to provide HHS with a meaningful and useful product at the end of this contract?
Didn’t think so.
2) Using Twitter, I almost mask who I really am… my true self, which is a Jesus lover, I don’t if I want to expose that too much over there. There is always the tension between:
It’s the inside of the cup that matters, not the outside
and
Do you hide a light under a bushel?
