Linux Command Line Client

Download ACME client

You can download Peeringhub's ACME client from:

https://github.com/peeringhub/RHEL-ACME-Cllient

Installation

Install app dependencies:

# dnf install curl openssl libuuid

Deploy the program:

$ tar -xvf dnl_acme_client.tar.gz

Configuration

ACME client uses configuration file ./acme_client.conf:

  • server_url - ACME server URL (https://stica.peeringhub.io/acme)

  • kid - Any human-readable string, which can identify the client (e.g. Company Name)

  • pa_user_id - Iconectiv login

  • pa_password - Iconectiv password

Certificate creation

  1. Create EC private key:

  1. Get SPC from Iconectiv (if do not have one):

If server doesn't have a white-listed at Iconectiv IP address, ACME client cannot generate SPC tokens, required to prove ownership of SP account. In that case, you must use SPC token file, acquired from a different server, and skip this step.

For regular SP certificate:

For SCA certificate:

  1. Create a new certificate order:

Your "O" and "CN" values must be unique. STI certificates shall include a Subject field containing a Distinguished Name (DN), which is unique for each subject entity certified under one CA issuer identity, as specified in RFC 5280 [Ref 11].

6.4.1 STI Certificate Requirements

This section defines the STI Certificate profile that shall be supported by SHAKEN-compliant STI-CAs and Service Providers.

....

STI certificates shall include a Subject field containing a Distinguished Name (DN), which is unique for each subject entity certified under one CA issuer identity, as specified in RFC 5280 [Ref 11]. The DN shall contain a Country (C=) attribute, a Common Name (CN=) attribute and an Organization (O=) attribute. Other DN attributes are optional. For non-End-Entity CA certificates (Basic Constraints CA boolean = TRUE), the Common Name attribute shall include the text string "SHAKEN" and also indicate whether the certificate is a root or intermediate certificate (e.g., CN=SHAKEN root). The Common Name attribute of an End-Entity certificate shall contain the text string “SHAKEN”, followed by a single space, followed by the SPC value identified in the TNAuthList of the End-Entity certificate (e.g., "CN=SHAKEN 1234"). The Organization (O=) attribute shall include a legal name of the service provider in order to facilitate traceback and operations. STI certificates shall include an Issuer field. For root certificates, the Issuer field shall match the certificate’s Subject field. For intermediate and End-Entity certificates, the Issuer field shall match the Subject field of the parent certificate.

"Subject" string combination must be unique for all valid certificates.

Example command line on generating certificates:

For regular SP certificate:

For SCA certificate:

You can use {not_before} and {not_after} field to set the validity period of the certificate you are generating.

If you put 0 to not_before and not_after variables, Peeringhub's ACME server will assume a one year validity.

However, if your Stir/Shaken subscription is expiring earlier than 1 year, then the certificate will end on the subscription expiration date.

There are many free online service that can convert date to timestamp for you. One such site is https://www.epochconverter.com/

Review downloaded certificate:

Account management

Login and list active orders

Change account's access key

  1. Create new EC private key:

  1. Update key on server:

Deactivate account

PreviousWindows Command Line ClientNextStaging Environment Support

Last updated