InterScanTM Messaging Security Virtual Appliance - Online Help ...

Trend Micro InterScan Messaging Security Virtual Appliance Administrator’s Guide
11-18
[root@imsva82b ~]#
After completing this procedure, the /tmp/linux_key.pem file contains the
linux.course.test private key in PEM-format. The /tmp/linux_req.pem file
contains the unsigned certificate (certificate request) in the PEM-format.
Signing the IMSVA Certificate
Signing the certificate is an optional procedure. The certificate must be signed if you do
not want to distribute all the certificates on systems and only distribute the CA
certificate. To confirm that the IMSVA Certificate (/tmp/imsva_req.pem) is trusted
by the CA, you need to sign the IMSVA certificate request by the CA private key
(/tmp/root_key.pem) but before doing this you need to set up the OpenSSL
environment for CA:
1. Update the OpenSSL configuration file /etc/pki/tls/openssl.cnf.
Find the definition of the [ CA_default ]/ dir parameter and change it to
/etc/pki/CA:
[ CA_default ]
dir = /etc/pki/CA # Where everything is kept
2. Create the empty index.txt file in the /etc/pki/CA directory:
[root@imsva82b ~]# touch /etc/pki/CA/index.txt
[root@imsva82b ~]#
3. Create the serial file with initial content in the /etc/pki/CA directory:
[root@imsva82b ~]# echo "01" > /etc/pki/CA/serial
[root@imsva82b ~]#
4. Sign the certificate:
[root@imsva82b ~]# openssl ca -days 365 -cert
/tmp/root_req.pem –keyfile /tmp/root_key.pem -in
/tmp/imsva_req.pem -out /tmp/imsva_cert.pem -outdir /tmp
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /tmp/root_key.pem:Trend
Check that the request matches the signature