Manual ini dilakukan pada satu komputer yang berfungsi sekaligus sebagai CA/CA-node/RA-node/RA/LDAP.
1. Download Source Open CA
Cari versi terbaru dari OpenCA. Ketika tulisan ini dibuat adalah versi 0.9.2.5
# tar -xzvf OpenCA-0.9.2.5# cd OpenCA-0.9.2.52. Instalasi Paket Pendukung
# apt-get install libxml-perl libxml-regexp-perl libdbi-perlperl-modules libssl-dev libldap2 libldap2-dev libnet-ldap-perllibdbd-mysql libdbd-mysql-perl libdbd-pg-perl libxml-perllibxml-twig-perl apache apache-ssl mysql-client mysql-server openssl3. Instalasi RA
# make distclean# ./configure \ --prefix=/usr/local/openra \ --with-httpd-user=www-data \ --with-httpd-group=www-data \ --with-openca-prefix=/usr/local/openra/openca \ --with-etc-prefix=/usr/local/openra/openca/etc \ --with-httpd-fs-prefix=/usr/local/openra/httpd \ --with-module-prefix=/usr/local/openra/modules \ --with-node-prefix=ra-node \ --with-engine=no \ --with-web-host=localhost \ --enable-ocspd \ --enable-dbi \ --enable-rbac \ --with-hierarchy-level=ra \# make# make install-online4. Instalasi CA# make distclean# * ./configure \ --prefix=/usr/local/openca \ --with-httpd-user=www-data \ --with-httpd-group=www-data \ --with-openca-prefix=/usr/local/openca/openca \ --with-etc-prefix=/usr/local/openca/openca/etc \ --with-httpd-fs-prefix=/usr/local/openca/httpd \ --with-module-prefix=/usr/local/openca/modules \ --with-node-prefix=ca-node \ --with-engine=no \ --with-web-host=localhost \ --enable-ocspd \ --enable-dbi \ --enable-rbac \ --with-hierarchy-level=ca # make# make install-offline5. Membuat Database CA dan RA
# mysql -u root -p> create database openca;> create database openra;> grant all privileges on openca.* to "openca"@"localhost" identified by "openca";> grant all privileges on openra.* to "openra"@"localhost" identified by "openra";6. Konfigurasi Web Server
Tambahkan pada file konfigurasi web server
# vi /etc/apache/httpd.conf# OpenCA Mods# CA AliasesAlias /ca /usr/local/openca/httpd/htdocs/ca/Alias /ca-node /usr/local/openca/httpd/htdocs/ca-node/ScriptAlias /cgi-bin/ca/ /usr/local/openca/httpd/cgi-bin/ca/ScriptAlias /cgi-bin/ca-node/ /usr/local/openca/httpd/cgi-bin/ca-node/# OpenCA Mods# RA AliasesAlias /ra /usr/local/openra/httpd/htdocs/ra/Alias /pub /usr/local/openra/httpd/htdocs/pub/Alias /ra-node /usr/local/openra/httpd/htdocs/ra-node/ScriptAlias /cgi-bin/ra/ /usr/local/openra/httpd/cgi-bin/ra/ScriptAlias /cgi-bin/pub/ /usr/local/openra/httpd/cgi-bin/pub/ScriptAlias /cgi-bin/ra-node/ /usr/local/openra/httpd/cgi-bin/ra-node/# LDAP ModsAlias /ldap/ /usr/local/openra/httpd/htdocs/ldap/ScriptAlias /cgi-bin/ldap/ /usr/local/openra/httpd/cgi-bin/ldap/#OpenCA Mods Directory AllowOverride None Options ExecCGI Order allow,deny Allow from all AllowOverride None Options ExecCGI Order allow,deny Allow from all AllowOverride None Options FollowSymLinks Indexes Order allow,deny Allow from all AllowOverride None Options FollowSymLinks Indexes Order allow,deny Allow from all# OpenCA Mods# adding dir to symlinks following for cert retrieval# not totally clear WHY openca puts a symlink here, but it did. AllowOverride None Options FollowSymLinks Indexes Order allow,deny Allow from all AllowOverride None Options FollowSymlinks Indexes Order allow,deny Allow from all7. Konfigurasi config.xml untuk RA# cp /usr/local/openra/openca/etc/config.xml /usr/local/openra/openca/etc/config.xml.default# vi /usr/local/openra/openca/etc/config.xmlgeneral options ca_organization PAUME ca_locality ITB ca_country ID service_mail_account (set to za@students.ee.itb.ac.id) dbmodule -> DBI for the mysql database db_type-> mysql db_name -> openra db_host -> localhost (or whatever) db_port -> 3306 (the mysql default port) db_user -> openra db_passwd -> openradataexchange configuration (2) The node acts as a RA only dataexchange_device_up /usr/local/openca/openca/var/tmp/ca-down dataexchange_device_down /usr/local/openra/openca/var/tmp/ra-down dataexchange_device_local /usr/local/openra/openca/var/tmp/ra-local 8. Konfigurasi config.xml untuk CA# cp /usr/local/openca/openca/etc/config.xml /usr/local/openca/openca/etc/config.xml.default# vi /usr/local/openca/openca/etc/config.xmlgeneral options ca_organization PAUME ca_locality ITB ca_country ID service_mail_account (set to za@students.ee.itb.ac.id) dbmodule -> DBI for the mysql database db_type-> mysql db_name -> openra db_host -> localhost (or whatever) db_port -> 3306 (the mysql default port) db_user -> openra db_passwd -> openradataexchange configuration (3) The node acts as a CA only dataexchange_device_up /usr/local/openca/openca/var/tmp/ca-up dataexchange_device_down /usr/local/openca/openca/var/tmp/ca-down dataexchange_device_local /usr/local/openra/openca/var/tmp/ra-local 9. Setting Protokol http CA dan RA
# vi /usr/local/openra/openca/etc/access_control/*.template set to .* keylength 0# vi /usr/local/openra/openca/etc/access_control/*.template set to .* keylength 010. Jalankan Magic-Script CA dan RA
/usr/local/openra/openca/etc# ./configure_etc.sh/usr/local/openca/openca/etc#./configure_etc.shPastikan tidak ada pesan error yang muncul.
11. Jalankan RA
/usr/local/openra/openca/etc# ./openca_rc stop/usr/local/openra/openca/etc# ./openca_start start12. Jalankan CA
/usr/local/openca/openca/etc# ./openca_rc stop/usr/local/openca/openca/etc# ./openca_start start.... akan dilanjutkan dengan (segera)
1. Inisialisasi RA dan CA
2. Langkah-Langkah Membuat Sertifikat
