> 12.1.1 | Create a Secure Data Transfer Environment Step by Step

> The following steps describe the configuration:

> • | The certificate exists within the module (see Section 12.2.1, Step 1).

> • | Certificate verification is activated for a data connection (HTTPS or SecureConnection).

> The steps described below use the cygwin + openssl environment (for installation see http://www.cygwin.com/. The openssl documentation can be found here http://www.openssl.org/docs/apps/openssl.html)
> A CA Root certificate is generated. This certificate can be placed on the HTTPS-Server. Another possibility is to use the private key of the certificate in order to sign thereby a server certificate. Both certificates form then a chain, which can be examined by the ME. A step-by-step description for the latter scenario can be found below.

> 1. | Create CA and generate CA Root Certificate

> - | We need certificates with sha1 signature. Java Security supports a sha1 signature of the certificate only. Add the parameter "-sha1" to the command "Making CA certificate ..." in the section of file CA.pl (cygwin location \cygwin\usr\ssl\misc”)

> - | Create a shell (use location \cygwin\usr\ssl\misc)

> - | Execute commands

> >perl CA.pl –newca

> - | Convert file format from PEM to DER CA certificate cacert.pem

> >openssl x509 -in ./demoCA/cacert.pem -inform PEM -out ./demoCA/cacert.der -outform DER

> CA private key file cakey.pem

> >openssl pkcs8 -in ./demoCA/private/cakey.pem -inform PEM -out ./demoCA/private/cakey.der -outform DER -nocrypt -topk8

> 2. | Create server certificate and java keystore

> - | Execute command

> >keytool -genkey -alias server -keypass keypass -keystore customer.ks -storepass keystorepass -sigalg SHA1withRSA -keyalg RSA

> The field “name” of the certificate is the domain name or the IP address of the server.

> 3. | Create certificate request for server certificate

> - | Execute command

> >keytool -certreq -alias server -file server.csr -keypass keypass -keystore customer.ks -storepass keystorepass

> 4. | Sign certificate request by CA

> - | Execute command

> >openssl ca -in server.csr -out server.pem

> - | Convert file format from PEM to DER

> >openssl x509 -in server.pem -inform PEM -out server.der -outform DER

> 5. | Import CA root certificate and CA private key into java keystore

> - | Use the CA Root Certificate for the creation of Java Security Command. See Section 12.5.3.

> - | Execute command

> >java -jar setprivatekey.jar -alias dummyca -storepass keystorepass -keystore customer.ks -keypass cakeypass -keyfile ./democa/private/cakey.der -certfile ./democa/cacert.der

> 6. | Export private key from server certificate

> - | The private key is needed for the (HTTPS or Secure Connection)server configuration.

> - | Execute command

> java -jar getprivatekey.jar -alias server -keystore customer.ks -storepass keystorepass -keypass keypass -keyfile server_privkey.der

> - | Convert format

> >openssl pkcs8 -in server_privkey.der -inform DER -out server_privkey.pem -outform PEM -nocrypt

> 7. | Send CA Root Certificate to the module

> - | Create Java Security Command “SetRootCert”. See Section 12.5.3.

> - | Send this command with AT^SJSEC to the module. See Section 12.4.3.

> 8. | Send Java Security Command “Switch on Certificate Verification for HTTPS Connections” to the module. See Section 12.5.3.

> Result:

> - | You have a keystore for the configuration of the Java Security of the module.

> - | You have a signed server certificate (files “server.pem” or “server.der”).

> - | You have a private key file for your server configuration (files "server_privkey.pem" or "server_privkey.der.

> - | The module contains the CA Root Certificat.

> - | HTTPS certificate verification is activate.

> Consult the documentation of your web server on how to set.up the certificate on it.