Main Page

From A-Space Developer Manual

This wiki is not sponsored by the US Government. It is an independent project meant to supplement the official documentation.

The purpose of this wiki is to build a definitive resource for integrating LAMP-based services into BRIDGE, the Director of National Intelligence's testbed for new analysis tools. The official BRIDGE integration guide is targeted at Java- and .net-based services. You may want to read the FAQ to get up to speed on what BRIDGE is all about and why it's worth developing for.

[edit] The Basic Requirements

There are a few things you need to know and have if you want to get started:

Everything you build has to be entirely Web-based. No desktop installations, including any Web-based services that run on top of a local installation like Greasemonkey.
You have to host your tool yourself, and you will need your own server, virtual or otherwise. I use Slicehost and love it.
Your host has to be SSL-enabled. More details on this below.

[edit] Step 1: Become a BRIDGE user

Go sign up for a BRIDGE user certificate. Wait a while...maybe a few minutes, maybe a few days...and you'll get an email saying your user certificate has been approved. It'll tell you how to install that certificate into your browser.

[edit] Step 2: SSL and Certificates

From a terminal, SSH into your server and:

sudo a2enmod ssl

That will enable the Apache SSL module, which allows you to generate keys and certificate requests.

You're now going to generate a private key and a certificate request. cd to a private directory where you'd like to save them (I created a directory called certs under /etc/ssl), then

sudo openssl genrsa -des3 -out www.mydomain.com.key 2048

That's slightly different from the official BRIDGE instructions, which don't include the -des3. des3 will ask you to generate a passkey; you'll then have to provide that passkey each and every time you restart your server, which you'll be doing a lot. If you forget it, starting over is quite a pain. You don't have to use des3, but I do.

Replace "www.mydomain.com" with whatever you like; it doesn't necessarily have to be a domain name.

sudo openssl req –new –key www.mydomain.com.key –out servicename.bridge-ic.net.csr

Replace "www.mydomain.com.key" with whatever you used in the previous command. "servicename.bridge-ic.net.csr" is not as flexible: you must choose a name for the thing you're building for BRIDGE and use it here in place of "servicename". Then you'll get a few prompts for information. VeriSign has a few instructions mutuellefor these prompts; I don't know how hard-and-fast they are, but I followed them and had no problems.

After this, you'll have two files: a .key file and a .csr file. The .key file is private; never share it with anyone. Take a look at the .csr file with:

sudo cat servicename.bridge-ic.net.csr

You'll see something like this:

Copy all of that stuff. Then go paste it into the form on the BRIDGE server certificate request form. You won't be able to access that form unless you've completed step 1 above and are accessing the site from a browser with your BRIDGE user certificate.

After this, you'll get an email telling you how to download your cert file, called servicename.bridge-ic.net.cert. Put that into the same directory as your other certs.

Next, copy the below text. It is the BRIDGE public certificate:

Create a new file in your certificates directory and call it bridge-ic.net.cert. Paste the above into that file, save it, and close it.

Almost done. We need one last certificate: the revoked user certificate certificate. This helps you authenticate each user. Copy and paste the below into a new file called bridge-ic.net.crl, and save it to your /certs directory:

[edit] Server Configuration

Next we have to set up our Apache site configuration file. Open the conf file that corresponds to the site you're creating, or create it if it doesn't exist.

    SSLEngine On 
    SSLCertificateFile /etc/ssl/certs/myservicename.bridge-ic.net.cer 
    SSLCertificateKeyFile /etc/ssl/certs/myservicename.bridge-ic.net.key 
    SSLVerifyClient require 
    SSLVerifyDepth 10 
    SSLCACertificateFile /etc/ssl/certs/bridge-ic.net.cer 
    SSLCARevocationFile /etc/ssl/certs/bridge-ic.net.crl

Main Page

From A-Space Developer Manual

Contents

[edit] The Basic Requirements

[edit] Step 1: Become a BRIDGE user

[edit] Step 2: SSL and Certificates

[edit] Server Configuration

Views

Personal tools

Navigation

Search

Toolbox