I have done this, according to http://www.tc.umn.edu/~brams006/selfsign.html, part 1B (generating your own CA):
a) create a CA authority (ca.key and ca.crt)
b) make a certificate request (server.csr)
c) sign the certificate request (server.crt and server.key) with the new CA authority
d) change the server key so it does not ask for a passphrase.
Afterwards, the server.crt and server.key files are included in /usr/share/fred-client/ssl directory, and the fred-client configuration file is modified like this:
ssl_cert = %(dir)s/server.crt
ssl_key = %(dir)s/server.key
Now, if I try to run fred-client this is the result:
ERROR: socket.sslerror: [Errno 1] _ssl.c:480: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (200.107.82.18:700)
Certificate not signed by verified certificate authority
What should I do for fred-client to identify these certificates as valid?.
Thanks in advance.
Note: the new fred-client is perfectly compatible with FRED 2.2.
--
Mario Guerra <mguerra(a)nic.cr>
Jaromir,
Just one or two more clarifications on FRED:
1. Is there a default maximum number of years (or months) for renewing a domain ?
I see that in .cz this is required to be 10 years - is this burned into FRED or can it be
modified?
See: https://www.nic.cz/files/nic/doc/Registration_rules_CZ.pdf
Regards,
Paulos
======================
Dr Paulos B Nyirenda
NIC.MW & .mw ccTLD
http://www.registrar.mw
While running
# apt-get update
on Ubunto-16 as warning is issued:
W: http://archive.nic.cz/ubuntu/dists/xenial/Release.gpg: Signature by key
55360425D50EB41DB9A21E67F20C079E020ADBB4 uses weak digest algorithm (SHA1)
It seems that Debian and friends do not like SHA1 any longer.
They provide more info on the removal of sha1 and how to fix a half-broken
repositories
https://wiki.debian.org/Teams/Apt/Sha1Removal
I suppose the fred repository for ubunto at archive.nic.cz could be updated
along those lines.
We are to try out having a few extra national characters
áýúíóæøåð
and in uppercase these are
ÁÝÚÍÓÆØÅÐ
in ccTLD names (.fo)
We found the 'allow_idn' in server.conf
and have it set as 'true' (allow_idn = true),
but this seems not to be enough, and does not really fullfill the requirements.
IDN is mentioned an option in fred, but where/how can we turn this on,
and what should we be aware of ?
...torkil...
