Ssl Certificates - Siemens RUGGEDCOM ROS User Manual

Chapter 1
Introduction
• Section 1.2.2.1, "SSL Certificates"
• Section 1.2.2.2, "SSH Key Pairs"
Section 1.2.2.1

SSL Certificates

ROS supports SSL certificates that conform to the following specifications:
• X.509 v3 digital certificate format
• PEM format
• RSA key pair, 512 to 2048 bits
The RSA key pair used in the default certificate and in those generated by ROS uses a public key of 1024 bits in
length.
NOTE
RSA keys smaller than 1024 bits in length are not recommended. Support is only included here for
compatibility with legacy equipment.
NOTE
The default certificate and keys are common to all ROS versions without a certificate or key files. That
is why it is important to either allow the key auto-generation to complete or to provision custom keys. In
this way, one has at least unique, and at best, traceable and verifiable keys installed when establishing
secure communication with the unit.
NOTE
RSA key generation times increase depending on the key length. 1024 bit RSA keys may take several
minutes to generate, whereas 2048 bit keys may take significantly longer. A typical modern PC system,
however, can generate these keys in seconds.
The following (bash) shell script fragment uses the openssl command line utility to generate a self-signed
X.509 v3 SSL certificate with a 1024 bit RSA key suitable for use in ROS . Note that two standard PEM files are
required: the SSL certificate and the RSA private key file. These are concatenated into the resulting ssl.crt file,
which may then be uploaded to ROS:
# RSA key size:
BITS=1024
# 20 years validity:
DAYS=7305
# Values that will be stored in the Distinguished Name fields:
COUNTRY_NAME=CA
STATE_OR_PROVINCE_NAME=Ontario
LOCALITY_NAME=Concord
ORGANIZATION=Ruggedcom.com
ORGANIZATION_CA=${ORGANIZATION}_CA # Your Certificate Authority
COMMON_NAME=RC
ORGANIZATIONAL_UNIT=ROS
# Variables used in the construction of the certificate
REQ_SUBJ="/C=${COUNTRY_NAME}/ST=${STATE_OR_PROVINCE_NAME}/L=${LOCALITY_NAME}/O=${ORGANIZATION}/OU=
${ORGANIZATIONAL_UNIT}/CN=${COMMON_NAME}/"
REQ_SUBJ_CA="/C=${COUNTRY_NAME}/ST=${STATE_OR_PROVINCE_NAME}/L=${LOCALITY_NAME}/O=${ORGANIZATION_CA}/
OU=${ORGANIZATIONAL_UNIT}/"
4
# Two-letter country code
# State or Province
# City
# Your organization's name
# The DNS or IP address of the ROS unit
# Organizational unit name
RUGGEDCOM ROS
User Guide
SSL Certificates