• Topic
  • Discussion
    • ODS.ODSGenerateX509Certificate(Last) -- DAVWikiAdmin? , 2017-06-29 07:29:44 Edit
    [TXT]
    [PLAIN]
    [DOCBOOK]
    WebDAV System Administrator 2017-06-29 07:29:44

    Generating WebID?-watermarked X.509 Certificates for Use with ODS

    Why use X.509 Certificates for Authentication?

    Password-based authentication is inherently difficult to maintain, and presents an awkward option in the context of RESTful client/server interactions over local and wide area networks (LANs and WANs).

    X.509 Certificates provide an elegant alternative which is more easily maintained, with a more streamlined user experience overall.

    How are X.509 Certificates generated?

    Thanks to its Virtuoso underpinnings, ODS possesses built-in functionality for generating X.509 Certificates with WebID? watermarks.

    With ODS, certificate generation is typically done through a web browser. The specific process varies because each browser vendor has chosen their own approach to manage Certificates and their associated Private Keys.

    Below, we cover certificate generation for several browsers, with keystore persistence handled variously by the host operating system or the Browser.

    Certificate Generation & Keystore Management

    Browser Generation Sort in descending order OS-based Keystore Browser-based Keystore Notes
    IE Windows-native generator Y
    (Windows only)     		N Best reserved for advanced users.
    Firefox .NET-based browser plug-in Y N
    Chrome <keygen/> Y N
    Firefox <keygen/> N Y
    IE OpenLink X.509 Certificate Generator plug-in Y N When using the user-friendly, Wizard-style interface of this plug-in, you (the issuer) must create a root CA certificate before generating any WebID?-watermarked certificates.
    Opera <keygen/> N Y
    Safari <keygen/> Y N

    X.509 Certificate Generation Methods

    Using ODS

    Using Virtuoso Certificate Generation Wizard (Windows only)

    Using Windows-Native Keystore

    1. View Local Machine KeyStore and enable a snap-in.
    2. Generate Certificate Guide.
    3. Import the generated Cert in ODS by pasting its content in the X.509 Certificate text-area presented at User Profile -> Edit -> Security -> X.509 Certificates tab page.

    Using openssl

    You can manually use OpenSSL? to generate the certificate, and then import that Certificate to ODS through its PEM Import UI. Then, both Certificate and Private Key must be imported into the OS- and/or browser-based keystore. Finally, the Cert results in Public Key and WebID? relation in Profile Graph.

    Basic Steps

    1. Generate x.509 Certificate.
    2. Set up HTTPS Support in Virtuoso.
    3. Configure your ODS Account to use the WebID Protocol.
    4. Test the setup.

    Browser-Specific Notes

    • Firefox: You must import the Private Key into the OS- and/or Browser-based keystore(s) using the relevant import mechanism.
    • Opera: You must import the Private Key into the OS- and/or Browser-based keystore(s) using the relevant import mechanism.

    OS-Specific Notes

    • Mac OS X: OpenSSL? is not needed. The Mac-native keystore lets you create certificates, based on Apple's root CA.
    • Windows: OpenSSL? is not needed. The Windows-native keystore lets you create certificates, based on Microsoft's root CA.

    Related