Template:TLS&DTLS encryption & certificate generation - Revision history

MindaugasK at 12:55, 14 July 2022

2022-07-14T12:55:29Z

← Older revision		Revision as of 15:55, 14 July 2022
Line 149:		Line 149:
	[[File:Certificate generation3.png\|500px]]		[[File:Certificate generation3.png\|500px]]

	Figure 16: Copying certificate.pem into root.pem file		Figure 16: Copying certificate.pem into root.pem file.

	In total, there should be 4 files inside of the SSL directory created		In total, there should be 4 files inside of the SSL directory created.

	[[File:Certificate generation4.png\|500px]]		[[File:Certificate generation4.png\|500px]]

MindaugasK at 12:50, 14 July 2022

2022-07-14T12:50:48Z

← Older revision		Revision as of 15:50, 14 July 2022
Line 157:		Line 157:
	Figure 17: SSL folder with different certification files created by issuing commands.		Figure 17: SSL folder with different certification files created by issuing commands.

			==Certificate uploading to Server==
	==Certificate uploading to Device==		==Certificate uploading to Device==
	~~==Certificate uploading to Server==~~
	==Testing the TLS encryption between the server and the device==		==Testing the TLS encryption between the server and the device==

MindaugasK at 12:50, 14 July 2022

2022-07-14T12:50:20Z

← Older revision		Revision as of 15:50, 14 July 2022
Line 15:		Line 15:
	Download the latest available OpenSSL software (light version) with .exe or .msi extensions, in this case the latest one is currently "Win64 OpenSSL v3.0.5 Light". Click on EXE and the file download will start		Download the latest available OpenSSL software (light version) with .exe or .msi extensions, in this case the latest one is currently "Win64 OpenSSL v3.0.5 Light". Click on EXE and the file download will start

	[[File:Openssl location.png \| ~~500x500px~~]]		[[File:Openssl location.png\|500px]]

	Figure 2: OpenSSL download links		Figure 2: OpenSSL download links
Line 25:		Line 25:
	'''The installation path has to be remembered as it will be required in the later stages.'''		'''The installation path has to be remembered as it will be required in the later stages.'''

	[[File:Openssl install1.png\|~~500x500px~~]]		[[File:Openssl install1.png\|500px]]

	Figure 3: Install location		Figure 3: Install location
Line 31:		Line 31:
	Use of /bin directory is advisable for intallation process, because "Windows system directory" can become tricky and overloaded.		Use of /bin directory is advisable for intallation process, because "Windows system directory" can become tricky and overloaded.

	[[File:Openssl install3.png\|~~500x500px~~]]		[[File:Openssl install3.png\|500px]]

	Figure 4: Use of /bin directory as preference.		Figure 4: Use of /bin directory as preference.
Line 39:		Line 39:
	Press Windows key and type "This PC", a folder with computer visible drives will open. Once there, right-mouse click on the empty space will bring options window, where the user is required to click on "Properties".		Press Windows key and type "This PC", a folder with computer visible drives will open. Once there, right-mouse click on the empty space will bring options window, where the user is required to click on "Properties".

	[[File:Properties window.png\|~~500x500px~~]]		[[File:Properties window.png\|500px]]

	Figure 5: This PC window with options pop up.		Figure 5: This PC window with options pop up.
Line 45:		Line 45:
	Once clicked, a new window with system information will open, in there select "Advanced System Settings".		Once clicked, a new window with system information will open, in there select "Advanced System Settings".

	[[File:System page.png\|~~500x500px~~]]		[[File:System page.png\|500px]]

	Figure 6: System Information window.		Figure 6: System Information window.
Line 156:		Line 156:

	Figure 17: SSL folder with different certification files created by issuing commands.		Figure 17: SSL folder with different certification files created by issuing commands.

			==Certificate uploading to Device==
			==Certificate uploading to Server==
			==Testing the TLS encryption between the server and the device==

MindaugasK at 12:42, 14 July 2022

2022-07-14T12:42:42Z

@@ Line 9: / Line 9: @@
 [[File:Openssl.png]]
-Figure 1: website link to OpenSSL software download
+Figure 1: Website link to OpenSSL software download
 Once the Wiki page is open, click on the highlighted link in Figure 1 - https://slproweb.com/products/Win32OpenSSL.html. A new page will open with the multiple downloadable files.
@@ Line 27: / Line 27: @@
 [[File:Openssl install1.png|500x500px]]
-Figure 3: install location
+Figure 3: Install location
 Use of /bin directory is advisable for intallation process, because "Windows system directory" can become tricky and overloaded.
@@ Line 33: / Line 33: @@
 [[File:Openssl install3.png|500x500px]]
-Figure 4: use of /bin directory as preference.
+Figure 4: Use of /bin directory as preference.
 Once installation process is complete, it is required to set up a path to the system preferences so that OpenSSL install location could be identified.
@@ Line 75: / Line 75: @@
 ==TLS certificate generation process==
-Open command prompt by pressing "Windows" key and typing cmd, once the icon is shown, right-click on it and select "Run as Administrator".
+Open command prompt by pressing "Windows" key and typing cmd, once the icon is shown, right-click on it and select "Run as administrator".
 [[File:Cmd run.png|500px]]
 Figure 11: Running CMD as an administrator.

MindaugasK at 11:12, 14 July 2022

2022-07-14T11:12:40Z

← Older revision		Revision as of 14:12, 14 July 2022
Line 73:		Line 73:
	Figure 10: New path variable added.		Figure 10: New path variable added.

	==TLS ~~Key Generation~~ process==		==TLS certificate generation process==

			Open command prompt by pressing "Windows" key and typing cmd, once the icon is shown, right-click on it and select "Run as Administrator".

			[[File:Cmd run.png\|500px]]

			Figure 11: Running CMD as an administrator.

MindaugasK at 10:37, 14 July 2022

2022-07-14T10:37:58Z

@@ Line 4: / Line 4: @@
 *Firmware FMB.Ver.03.27.xx
-==Download and install OpenSSL software:==
+==OpenSSL software download & installation process==
 Download OpenSSL from https://wiki.openssl.org/index.php/Binaries
@@ Line 35: / Line 35: @@
 Figure 4: use of /bin directory as preference.
-Once installation process is complete, it is required to set up a path to the system preferences so that OpenSSL could be identified.
+Once installation process is complete, it is required to set up a path to the system preferences so that OpenSSL install location could be identified.
-Press Windows key and type "This PC".
+Press Windows key and type "This PC", a folder with computer visible drives will open. Once there, right-mouse click on the empty space will bring options window, where the user is required to click on "Properties".

MindaugasK at 08:59, 14 July 2022

2022-07-14T08:59:59Z

← Older revision		Revision as of 11:59, 14 July 2022
Line 4:		Line 4:
	*Firmware FMB.Ver.03.27.xx		*Firmware FMB.Ver.03.27.xx

	==Download and install ~~OPEN VPN~~ software:==		==Download and install OpenSSL software:==
	Download OpenSSL from https://wiki.openssl.org/index.php/Binaries		Download OpenSSL from https://wiki.openssl.org/index.php/Binaries

	[[File:Openssl.png]]		[[File:Openssl.png]]

	Figure 1 ~~OPEN VPN installing process~~		Figure 1: website link to OpenSSL software download

	~~==Open command window (cmd.exe) as administrator:==~~		Once the Wiki page is open, click on the highlighted link in Figure 1 - https://slproweb.com/products/Win32OpenSSL.html. A new page will open with the multiple downloadable files.
	*After command window is ~~running (as administrator)~~, ~~open easy~~-~~rsa directory over CMD~~:
	~~Example: "cd C:\Program Files\OpenVPN\easy-rsa"~~

	~~'''IMG'''~~		Download the latest available OpenSSL software (light version) with .exe or .msi extensions, in this case the latest one is currently "Win64 OpenSSL v3.0.5 Light". Click on EXE and the file download will start

	~~Figure 2 easy-rsa command input and response~~		[[File:Openssl location.png \| 500x500px]]

	*In opened directory enter command init-config and run the following batch file to copy		Figure 2: OpenSSL download links
	~~configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files)~~

	~~'''IMG'''~~		Once the file is downloaded, open it and the installation process will start.

	~~Figure 3 init-config command input and response~~		Upon installation, it is advisable to install the software into the default location, however this can be chosen to the user's preference.

	~~==VAR.BAT file configuration:==~~		'''The installation path has to be remembered as it will be required in the later stages.'''
	~~Open vars.bat file with text editor (notepad++) and set parameters of your server described below (enter information that would match~~ to ~~your server and company information). While editing the vars file (called vars.bat on Windows) and set~~ the ~~following parameters:<br>~~
	*KEY_COUNTRY
	*KEY_PROVINCE
	*KEY_CITY
	*KEY_ORG
	*KEY_EMAIL parameters (don’t leave any of these parameters blank)<br>
	~~Example:~~
	*set KEY_COUNTRY=LT
	*set KEY_PROVINCE=LTUS
	*set KEY_CITY=Vilnius
	*set KEY_ORG=100.10.11.222
	*set KEY_EMAIL=info@teltonika.lt
	*set KEY_CN=100.10.11.~~222~~
	*set KEY_NAME=TeltonikaSUPPORT
	*set KEY_OU=FMB<br>

	~~'''IMG'''~~		[[File:Openssl install1.png\|500x500px]]

	Figure ~~4 Notepad++ view (configurable and default parameters)~~		Figure 3: install location

	~~After parameters changed~~, ~~save~~ and ~~close text editor~~.		Use of /bin directory is advisable for intallation process, because "Windows system directory" can become tricky and overloaded.

	~~==Enter commands into CMD==~~		[[File:Openssl install3.png\|500x500px]]
	~~Enter 3 commands listed below one after another~~:
	~~vars~~
	~~clean-all~~
	~~build-ca~~

	~~'''IMG'''~~		Figure 4: use of /bin directory as preference.

	~~Figure 5 vars~~, ~~clean-all, build-ca commands inputs and responses~~		Once installation process is complete, it is required to set up a path to the system preferences so that OpenSSL could be identified.

	~~After commands entered click enter to check all inserted parameters, when directory command appears~~		Press Windows key and type "This PC".
	~~check generated~~ key ~~in --> C:\Program Files\OpenVPN\easy-rsa\keys~~

	~~'''IMG'''~~

	~~Figure 6 printed parameters which will be used in encryption certificate~~

	~~==Generated key change==~~
	~~Copy all generated files from C:\Program Files\OpenVPN\easy-rsa\keys into new folder~~ and ~~change ca.crt~~
	~~file name and extension into root.pem~~

	~~'''IMG'''~~

	~~Figure 7 File name and extension change~~

	~~==Upload root certificate to device==~~
	~~NOTE! Certificate extension must be named~~ "~~root.pem~~"

	~~'''IMG'''~~

	~~Figure 8 File root.pem upload~~

	~~'''IMG'''~~

	~~Figure 9 Uploaded root file~~

	~~Note: to upload new root.pem file current file must be deleted from configuration before.~~

	~~==Configure server and enable encryption mode==~~
	~~'''IMG'''~~

	~~Figure 10 Configuration example~~

	~~==Download certificate function==~~
	~~To Download certificate from FMB device it is necessary to set a path in configurator settings.~~

	~~'''IMG'''~~

	~~Figure 11 Download certificate parameters.~~

	~~Then enter security window, mark certificate and click download.~~

	~~'''IMG'''~~

	~~Figure 12 Download root.pem certificate window~~.

MindaugasK at 05:31, 14 July 2022

2022-07-14T05:31:22Z

← Older revision		Revision as of 08:31, 14 July 2022
Line 1:		Line 1:
	Requirements to perform the encryption and generation of the certificate:		Requirements to perform the encryption and generation of the certificate:
	*Server with implemented TLS/DTLS functionality		*Server with implemented TLS/DTLS functionality
	*~~OPEN VPN~~ (or any other) software to generate certificate key		*OPENSSL (or any other) software to generate certificate key
	*Firmware FMB.Ver.03.27.xx		*Firmware FMB.Ver.03.27.xx

	==Download and install OPEN VPN software:==		==Download and install OPEN VPN software:==
	~~Link:~~ https://~~www~~.~~techspot~~.~~com~~/~~downloads~~/~~5182-openvpn.html~~		Download OpenSSL from https://wiki.openssl.org/index.php/Binaries
	~~During installation process enable "EasyRSA 2 Certificate Management Scripts"~~

	~~'''IMG'''~~		[[File:Openssl.png]]

	Figure 1 OPEN VPN installing process		Figure 1 OPEN VPN installing process

MindaugasK: Created page with "Requirements to perform the encryption and generation of the certificate: Server with implemented TLS/DTLS functionality OPEN VPN (or any other) software to generate certifi..."

2022-07-13T06:34:13Z

Created page with "Requirements to perform the encryption and generation of the certificate: *Server with implemented TLS/DTLS functionality *OPEN VPN (or any other) software to generate certifi..."

New page

Requirements to perform the encryption and generation of the certificate:
*Server with implemented TLS/DTLS functionality
*OPEN VPN (or any other) software to generate certificate key
*Firmware FMB.Ver.03.27.xx

==Download and install OPEN VPN software:==
Link: https://www.techspot.com/downloads/5182-openvpn.html
During installation process enable "EasyRSA 2 Certificate Management Scripts"

'''IMG'''

Figure 1 OPEN VPN installing process

==Open command window (cmd.exe) as administrator:==
*After command window is running (as administrator), open easy-rsa directory over CMD:
Example: "cd C:\Program Files\OpenVPN\easy-rsa"

'''IMG'''

Figure 2 easy-rsa command input and response

*In opened directory enter command init-config and run the following batch file to copy
configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files)

'''IMG'''

Figure 3 init-config command input and response

==VAR.BAT file configuration:==
Open vars.bat file with text editor (notepad++) and set parameters of your server described below (enter information that would match to your server and company information). While editing the vars file (called vars.bat on Windows) and set the following parameters:<br>
*KEY_COUNTRY
*KEY_PROVINCE
*KEY_CITY
*KEY_ORG
*KEY_EMAIL parameters (don’t leave any of these parameters blank)<br>
Example:
*set KEY_COUNTRY=LT
*set KEY_PROVINCE=LTUS
*set KEY_CITY=Vilnius
*set KEY_ORG=100.10.11.222
*set KEY_EMAIL=info@teltonika.lt
*set KEY_CN=100.10.11.222
*set KEY_NAME=TeltonikaSUPPORT
*set KEY_OU=FMB<br>

'''IMG'''

Figure 4 Notepad++ view (configurable and default parameters)

After parameters changed, save and close text editor.

==Enter commands into CMD==
Enter 3 commands listed below one after another:
vars
clean-all
build-ca

'''IMG'''

Figure 5 vars, clean-all, build-ca commands inputs and responses

After commands entered click enter to check all inserted parameters, when directory command appears
check generated key in --> C:\Program Files\OpenVPN\easy-rsa\keys

'''IMG'''

Figure 6 printed parameters which will be used in encryption certificate

==Generated key change==
Copy all generated files from C:\Program Files\OpenVPN\easy-rsa\keys into new folder and change ca.crt
file name and extension into root.pem

'''IMG'''

Figure 7 File name and extension change

==Upload root certificate to device==
NOTE! Certificate extension must be named "root.pem"

'''IMG'''

Figure 8 File root.pem upload

'''IMG'''

Figure 9 Uploaded root file

Note: to upload new root.pem file current file must be deleted from configuration before.

==Configure server and enable encryption mode==
'''IMG'''

Figure 10 Configuration example

==Download certificate function==
To Download certificate from FMB device it is necessary to set a path in configurator settings.

'''IMG'''

Figure 11 Download certificate parameters.

Then enter security window, mark certificate and click download.

'''IMG'''

Figure 12 Download root.pem certificate window.

Template:TLS&DTLS encryption & certificate generation - Revision history

MindaugasK at 12:55, 14 July 2022

MindaugasK at 12:50, 14 July 2022

MindaugasK at 12:50, 14 July 2022

MindaugasK at 12:42, 14 July 2022

MindaugasK at 11:12, 14 July 2022

MindaugasK at 10:37, 14 July 2022

MindaugasK at 08:59, 14 July 2022

MindaugasK at 05:31, 14 July 2022

MindaugasK: Created page with "Requirements to perform the encryption and generation of the certificate: *Server with implemented TLS/DTLS functionality *OPEN VPN (or any other) software to generate certifi..."

MindaugasK: Created page with "Requirements to perform the encryption and generation of the certificate: Server with implemented TLS/DTLS functionality OPEN VPN (or any other) software to generate certifi..."