Creating a certificate for remote workstations running Linux
Latest update: September 21, 2022
ID: 15890
Connecting to remote workstations in Kaspersky Thin Client requires that you verify and save a certificate in the thin client. To spare users from having to verify the certificates, upload the certificates to the plug-in policy of Kaspersky Security Management Suite. The devices synchronized with Kaspersky Security Center will receive these certificates.
To create a certificate on workstations running Linux, follow the steps below.
Step 1. Create a root certificate
If you don’t have OpenSSL, run the following command:
sudo apt install openssl
If you have OpenSSL installed, proceed as follows:
- Generate a root key with the command:
openssl genrsa -out rootCA.key 2048
- If you want to encrypt the key, run the command:
openssl genrsa -out rootCA.key -aes256
- To create the certificate, use the key created in the previous step and specify Common Name, Country, and other attributes in the subj parameter:
openssl req -x509 -key rootCA.key -out rootCA.crt -days 10000 -subj '/CN=MyRootCA.ru/C=RU/L=Moscow/O=My Organization Name/OU=My Organization Unit Name'
- You may be prompted to enter the key password during the execution of the command.
The root certificate will be created.
Step 2. Create a certificate for connecting to a Remote Desktop
- Generate a key with the command:
openssl genrsa -out ktc_rdp_stand.key 2048
- If you want to encrypt the key, run the command:
openssl genrsa -out rootCA.key -aes256
- To request the certificate, use the key created in the previous step and specify Common Name, Country, and other attributes in the subj parameter.
openssl req -new -key ktc_rdp_stand.key -out ktc_rdp_stand.csr -subj '/CN= ktc_rdp_test_stand/C=RU/L=Moscow/O=My Organization Name/OU=My Organization Unit Name' -addext "keyUsage = digitalSignature, keyEncipherment, dataEncipherment, cRLSign, keyCertSign" -addext "extendedKeyUsage = serverAuth, clientAuth"
- Sign the certificate request with the root certificate created earlier. The -days parameter can have any value.
openssl x509 -req -in ktc_rdp_stand.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out ktc_rdp_stand.crt -days 5000
The certificate for connecting to a Remote Desktop will be created.
