====== Runbook: Izdavanje certifikata ======

<WRAP round info>
**Trajanje:** ~10 minuta \\
**Uloga:** PKI operator \\
**Preduvjet:** Odobreni CSR
</WRAP>

----

===== Workflow =====

<mermaid>
flowchart TD
    A[CSR primljen] --> B{Validacija CSR-a}
    B -->|Nevaljan| C[Odbijanje + Ticket]
    B -->|Valjan| D{Odobrenje?}
    D -->|Ne| E[Zahtjev za odobrenje]
    D -->|Da| F[Potpisivanje certifikata]
    F --> G{Hibridni način?}
    G -->|Da| H[Dodavanje PQ ekstenzije]
    G -->|Ne| I[Klasično potpisivanje]
    H --> J[Isporuka]
    I --> J
    J --> K[Audit Log]

    style B fill:#fff3e0
    style F fill:#e8f5e9
    style H fill:#e3f2fd
</mermaid>

----

===== Korak 1: Primanje i validacija CSR-a =====

<WRAP round important>
**Kontrolna lista prije potpisivanja:**
</WRAP>

| # | Točka provjere | Naredba | Očekivano |
|---|----------------|---------|-----------|
| 1 | Format CSR-a valjan | ''openssl req -in request.csr -verify -noout'' | ''verify OK'' |
| 2 | Duljina ključa | ''openssl req -in request.csr -text \| grep "Public-Key"'' | >=2048 Bit (RSA), >=256 Bit (EC) |
| 3 | Subject ispravan | ''openssl req -in request.csr -subject -noout'' | Prema zahtjevu |
| 4 | SAN-ovi potpuni | ''openssl req -in request.csr -text \| grep -A1 "Subject Alternative"'' | Sva imena hostova |

<code bash>
# Potpuna provjera CSR-a
openssl req -in request.csr -text -noout -verify
</code>

----

===== Korak 2: Provjera odobrenja =====

| Tip certifikata | Odobrava | Dokumentacija |
|-----------------|----------|---------------|
| Server (interni) | Automatski / Ticket | Br. ticketa |
| Server (vanjski) | IT-Security | E-Mail + Ticket |
| Klijent | Voditelj odjela | Obrazac |
| Code-Signing | CISO | Pisano |

----

===== Korak 3: Potpisivanje certifikata =====

==== Klasični način ====

<code bash>
# Potpisivanje server certifikata (1 godina)
openssl ca -config openssl.cnf \
    -extensions server_cert \
    -in request.csr \
    -out certificate.pem \
    -days 365 \
    -notext

# Zabilježiti serijski broj
openssl x509 -in certificate.pem -serial -noout
</code>

==== Hibridni način (PQ) ====

<code csharp>
// C# s WvdS.System.Security.Cryptography
using var intermediate = new X509Certificate2("intermediate.pfx", "password");

var csr = CertificateRequest.LoadSigningRequest(
    File.ReadAllBytes("request.csr"),
    HashAlgorithmName.SHA256);

var cert = csr.Create(
    intermediate,
    DateTimeOffset.UtcNow,
    DateTimeOffset.UtcNow.AddDays(365),
    Guid.NewGuid().ToByteArray(),
    CryptoMode.Hybrid);  // PQ ekstenzija

File.WriteAllText("certificate.pem", cert.ExportCertificatePem());
</code>

----

===== Korak 4: Isporuka =====

| Format | Upotreba | Naredba |
|--------|----------|---------|
| PEM | Linux, Apache | ''cp certificate.pem /output/'' |
| PFX | Windows, IIS | ''openssl pkcs12 -export -in certificate.pem -inkey private.key -out certificate.pfx'' |
| DER | Java | ''openssl x509 -in certificate.pem -outform DER -out certificate.der'' |

<code bash>
# Isporuka s lancem
cat certificate.pem intermediate.pem > fullchain.pem
</code>

----

===== Korak 5: Dokumentacija =====

<WRAP round tip>
**Obavezna polja u ticketu/logu:**
</WRAP>

| Polje | Primjer |
|-------|---------|
| Serijski broj | ''01:23:45:67:89:AB:CD:EF'' |
| Subject | ''CN=server.example.com'' |
| Vrijedi do | ''2025-12-15'' |
| Izdao | ''Ime operatera'' |
| Br. ticketa | ''INC-2024-12345'' |
| Način | ''Hybrid / Classic'' |

----

===== Rješavanje problema =====

| Problem | Uzrok | Rješenje |
|---------|-------|----------|
| ''unable to load CSR'' | Pogrešan format | ''openssl req -inform DER -in request.der -out request.pem'' |
| ''signature verify failed'' | CSR manipuliran | Zatražiti novi CSR |
| ''wrong issuer'' | Pogrešan CA | Provjeriti CA certifikat |
| ''certificate request failed'' | Greška u konfiguraciji | Provjeriti ''openssl.cnf'' |

----

===== Povezani runbookovi =====

  * [[.:zertifikat-erneuern|Obnova certifikata]] – Za certifikate koji ističu
  * [[.:zertifikat-widerrufen|Opoziv certifikata]] – Kod kompromitacije
  * [[hr:int:pqcrypt:szenarien:kurzreferenz:csr|CSR kratki pregled]] – Primjeri koda

----

<< [[.:start|← Dnevne operacije]] | [[.:zertifikat-erneuern|→ Obnova certifikata]] >>

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional//

{{tag>runbook certifikat izdavanje operator}}