Learn FreeBSD - OpenSSL, TLS & Certificates

#Introduction

In the previous episode 13, you mastered IPFW and packet analysis. Now we turn to the transport security layer: encryption, certificates, and secure remote access. Without this, all the firewalls in the world won't protect data traveling in plain text across the network. This episode covers certificate creation, trust store management, hardening SSH with ed25519 keys, and SSH tunneling.

#OpenSSL and TLS

#OpenSSL in the Base System

FreeBSD ships OpenSSL as part of the base system. This version is maintained specifically by the FreeBSD team with attention to security and compatibility. Check its version:

Memeriksa versi OpenSSL

openssl version

#LibreSSL: The Alternative

For those who want an alternative version, LibreSSL (a fork of OpenSSL by OpenBSD) is available as a port. The comparison:

Aspect	Base OpenSSL	LibreSSL
Origin	FreeBSD base system	Separate package
Maturity	High, maintained by FreeBSD team	High, OpenBSD style
Compatibility	Comprehensive	Very good
Best for	Default on all systems	Specific needs

Info

For most systems, use the OpenSSL that ships with the base system. LibreSSL is useful when you want to avoid deprecated APIs or need more conservative, OpenBSD-style behavior.

#Creating Certificates with openssl

#Keys and CSRs

The standard flow: create a private key, then a Certificate Signing Request (CSR):

Membuat kunci dan CSR

openssl req -newkey rsa:2048 -nodes -keyout server.key -out server.csr

#Self-Signed Certificates

For internal testing, create a self-signed certificate:

Membuat sertifikat self-signed

openssl req -x509 -newkey rsa:2048 -days 365 -nodes -keyout server.key -out server.crt

Self-signed certificates are not trusted by browsers or other clients automatically — you have to add them to the trust store manually.

#Verifying Certificates

Memverifikasi sertifikat

openssl verify -CAfile ca.crt server.crt
openssl x509 -in server.crt -noout -text

#Trust Store Management

#ca_root_nss: The CA Bundle

Menginstal CA bundle

pkg install ca_root_nss

#Updating CAs

Memperbarui trust store

certctl list
certctl rehash

certctl is the modern tool for managing FreeBSD's trust store. certctl rehash rebuilds the certificate hashes in /etc/ssl.

Success

After installing ca_root_nss and running certctl rehash, CLI applications like curl and fetch will trust sites with public CA certificates — important for pkg and freebsd-update, which run automatically.

#Adding an Internal CA

Menambahkan CA internal

cp corp-ca.crt /etc/ssl/certs/corp-ca.crt
certctl rehash

#SSH Hardening

#Creating Keys with ssh-keygen

ed25519 keys are the modern choice — fast and secure:

Membuat kunci ed25519

ssh-keygen -t ed25519 -C "user@host"
ssh-copy-id user@server

#Secure sshd Configuration

Edit /etc/ssh/sshd_config to lock down access:

Konfigurasi sshd yang aman

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication no

Danger

Disable PasswordAuthentication only after you're sure the public key is installed and you can log in. Otherwise you'll lock yourself out. Test from an already-open SSH session before reloading sshd.

#Avoiding Outdated Keys

Membatasi algoritma host key

HostKey /etc/ssh/ssh_host_ed25519_key

#Applying Changes

Menerapkan perubahan sshd

sshd -t
service sshd restart

#SSH Tunneling

#Local Port Forwarding

SSH tunneling carries traffic through an encrypted connection. Example: access an internal service from your machine:

Port forwarding lokal

ssh -L 8080:internal-host:80 user@gateway

#Dynamic Forwarding (SOCKS)

A SOCKS proxy makes your machine "exist" on the remote network:

SOCKS proxy via SSH

ssh -D 1080 user@gateway

Warning

SSH tunneling gets through firewalls in a legitimate way, but make sure your network policy allows it. In a corporate environment, unauthorized tunnels are a common security audit finding.

#TLS and SSH Best Practices

Use ed25519 keys, not RSA 1024 or DSA.
Turn off root login and password authentication.
Install ca_root_nss and run certctl rehash periodically.
Store private keys with strict permissions (0600).
Update OpenSSL and TLS libraries via pkg upgrade and freebsd-update.

Rutinitas verifikasi keamanan

openssl version
ssh -V
service sshd status
certctl list | wc -l

#Closing

In this episode 14, you covered OpenSSL and TLS on FreeBSD: creating certificates with openssl req, verification, trust store management with ca_root_nss and certctl, hardening SSH with ed25519 and a secure sshd_config, and tunneling for secure remote access.

Key takeaways:

The base system OpenSSL is sufficient for general TLS needs; LibreSSL as an alternative.
Certificate flow: private key, CSR, sign or self-sign, then verify.
Install ca_root_nss and rehash the trust store so clients trust public CAs.
SSH hardening: disable root login and password auth, use ed25519.
Validate with sshd -t before restarting; SSH tunneling secures internal access.