AC-Tube
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
actube/ssl
7u83 b894c00a7e moved local_cfg, remote_cfg ... to cw_ElemData struct 6 months ago
..
README Fixed issues with creating cisco cert. 7 years ago
all.sh New files 6 months ago
mkcert.sh moved local_cfg, remote_cfg ... to cw_ElemData struct 6 months ago
mkcerts.sh partial conversion to OpenSSL 1.1.1 7 months ago
mkciscoimport.sh moved local_cfg, remote_cfg ... to cw_ElemData struct 6 months ago
mkclean.sh Cleans directories now 8 years ago
mkrootca.sh moved local_cfg, remote_cfg ... to cw_ElemData struct 6 months ago
openssl-crt.cnf moved local_cfg, remote_cfg ... to cw_ElemData struct 6 months ago
openssl-int.cnf moved local_cfg, remote_cfg ... to cw_ElemData struct 6 months ago
openssl.cnf moved local_cfg, remote_cfg ... to cw_ElemData struct 6 months ago

README



Creating SSL certificates to test AC-Tube and it's WTP's
========================================================

1. Create a root CA by executing:

./mkrootca.sh

This creates some root CAs and intermediate CAs in the
subdirectories ./root-ca and ./intermediate-ca to sign
certificates.


2. Create client certificates as needed

To create a client certificate, execute the script

./mkcert.sh <cert-name> [type]

where cert-name is the name of the certificate to be created
without extension and the optional parameter type specifies
the type of the certificate, which could be only 'cisco'
for now.
The created certificatte and key is found in the
folder ./certs
named cert-name.pem and cert-name.key.

If you chose 'cisco-ap' as type, the certificate will be
accepted by a Cisco WTP when used in AC-Tube. The firmare
on Cisco's AP must be at least 7.3.

EXAMPLE:
./mkcert.sh ac-cisco cisco-ap
will create the files ./certs/ac-cisco.pem and and ./certs/ac-cisco.key

On a Cisco AP you might have to reset the config over terminal,
before it will connet. Therefor do in enabeled mode:
clear capwap private-config
reload


3. Put these entries into ac.conf located in the ac directory,
so AC-Tube wilil use the certificates. If you have named your certificate
just 'ac', put the following into config:

ssl_key=../../ssl/certs/ac.key
ssl_cert=../../ssl/certs/ac.crt


Installing your own root ca an a Cisco WTP
==========================================

If you want to connect a Cisco 1130 series LAP to AC-Tube
using a certificate signed by a root ca of your choice, you
have to install the CA file on the WTP. Therofore you can
create a terminal script by executing:

./mkciscoimport.sh

Paste the result into a terminal session when in enabled mode.

To ac.conf add the following entry:

dtls_verify_peer = no

But remember, if you reboot the WTP the installed CA will be lost.
Currently there is no way to make the installation permanent.


If you experience with other Cisco LAPs (e.g. 1141), please tell me.
7u83@mail.ru.