Certificate Management; Overview; Sles Default Certificates - Novell OPEN ENTERPRISE SERVER - PLANNING AND IMPLEMENTATION GUIDE 12-2010 Implementation Manual

Certificate Management

2 2
By default, all SUSE Linux Enterprise Server (SLES) 10 servers include self-generated server
certificates to secure data communications with the servers. These certificates are self-signed and do
not comply with the X.509 RFCs. They are provided only as a stop-gap and should be replaced as
soon as possible by a certificate from a trusted Certificate Authority.
Unfortunately, many organizations ignore the vulnerabilities to mischievous or even malicious
attacks that are created by not replacing these temporary certificates. Some of the reasons for this are

Many administrators lack the knowledge required.

Certificate maintenance can require a significant investment of time and effort.

Obtaining third-party certificates for each server is expensive.
The problems are compounded by the fact that X.509 certificates are designed to expire regularly
and should be replaced shortly before they do.
Open Enterprise Server 2 includes solutions that address each of these issues at no additional
expense.
This section discusses the certificate management enhancements available in OES 2 and how simple
and straightforward it is to take advantage of these.

Section 22.1, "Overview," on page 227

Section 22.2, "Setting Up Certificate Management," on page 230

Section 22.3, "If You Don't Want to Use eDirectory Certificates," on page 232

22.1 Overview

The following sections outline how OES 2 lets you automate certificate management for OES 2 and
all HTTPS services:

Section 22.1.1, "SLES Default Certificates," on page 227

Section 22.1.2, "OES 2 Certificate Management," on page 228

Section 22.1.3, "Multiple Trees Sharing a Common Root," on page 230

22.1.1 SLES Default Certificates

By default, HTTPS services on SLES 10 SP1 are configured to use two files that are located in
and are protected so that only
etc/ssl/servercerts
them:

serverkey.pem: This contains the server's raw private key.

servercert.pem: This contains the server's certificates.
OES 2 services, such as Apache, OpenWBEM, and Novell Remote Manager, are also configured to
use these certificates.
and some specific groups can read
root
22
/
Certificate Management 227