This is openssl-0.9.7a for OS/2. with the patch against the
Klima-Pokorny-Rosa attack on RSA in SSL/TLS applied.

I compiled it on Warp4 with emx 0.9d using OS2-EMX.cmd from
the original tar ball. The DLLs and EXE are compressed with LXLite.

Put openssl in a directory in your PATH and the DLLs to a direcotory 
in your LIBPATH. Copy conf\openssl.cnf.demoCA to a directory of your 
choice and set the environement variable OPENSSL_CONF by putting

SET OPENSSL_CONF=D:\MPTN\etc\ssl\openssl.cnf

into CONFIG.SYS.

If you want to compile your own programs and link them with
the opensll put the files from include and lib to your emx directory. 
Note that openssl is a subdirectory of your include directory.
If you need .lib files you can create them using emxomf.

See the doc directory for some information and visit
http://www.columbia.edu/~ariel/ssleay/ for more infos.

Grab the full source at http://www.openssl.org/



There are many ways to make your own keys and certificates.

A good solution is to use sslRexx. It provides everithing you need

Here is a short desctription how I made my own Certification Authority, 
a Server Key for Apache and a client Key/Certificate for me, signed by my
own CA.


Root CA: The root CA is needed to sign all certificates
=======

Generate a CA-Key and store it in sub-directory private: 

openssl genrsa -des3  -out private/MyOwnCA.pem 2048

Make a selfsigned certificate based on above key.

openssl req -new -x509 -days 730 -key private/CAkey.pem -out CAcert.pem

optional generate text output of this certificate:

openssl x509 -in ./CAcert.pem -text > CAcert.txt

Now you have a key and certificate for your own CA which can be used
to sign user and server keys. The CAcert is also needed to configure 
Apache and Netscape. You can/should give away the CA certificate but
never give the CA key to anybody.


Make a Key and Certificate for the Apache Server
================================================

Generate a key  
--------------

openssl genrsa -des3 -out server-key.pem 2048

With this variant, you will be prompted for a protecting password.  If
you don't want your key to be protected by a password, remove the flag
'-des3' from the command line above.

 NOTE: if you intend to use the key together with a server     
 certificate, you may want to avoid protecting it with a password, 
 since that would mean someone would have to type in the password every 
 time the server needs to access the key. But then you should protect 
 the server key in another way. 


Create a signing request
------------------------

openssl req -new -key server-key.pem -out server-req.pem


Now send this request to your CA for signing. Since you are your own CA
sign it:
--------

openssl ca -in server-req.pem -out server-cert.pem -outdir MyOwnCA/newcerts

Verify the certificate

openssl verify -CAfile CAcert.pem server-cert.pem

Now you have a key and a certificate for your Apache Webserver. 


Your Client Certificate/Key
===========================

Generate a private key 
----------------------

openssl genrsa -des3 -out hrom-key.pem 2048

Create a signing request
------------------------

openssl req -new -key hrom-key.pem -out hrom-req.pem

Let the CA sign it
------------------

openssl ca -in hrom-req.pem -out hrom-cert.pem -outdir MyOwnCA/newcerts


After you get back the certificate from the CA, combine it with 
your private key and store the result as p12 file. This file can
be imported into your browser.

openssl pkcs12 -export -name Hromadka -in hrom-cert.pem -inkey hrom-key.pem -out hrom.p12


Securtiy Notes: Never give your private key to a CA, they only need the
signing request. Never give away your p12 file. Always secure your private
keys with a passphrase.


--
Johannes Hromadka
Johannes.Hromadka@gmx.net
2003-03-02
