Setting Up Web Application Work in Chromium-Gost Browser in Linux OS

The Chromium-Gost browser supports GOST cryptographic encryption algorithms. Consider setting up web application work in the Chromium-Gost browser using a certificate authority based on the example of the CryptoPro certificate authority.

To set up the web application, follow the steps given below. It is assumed that the we application works via the HTTPS protocol.

Step 1. Getting Security Certificates with GOST Encryption Algorithms

The private key of the server certificate and the server certificate that uses GOST encryption algorithms are generated in the PEM and CER formats using special software, for example, OpenSSL. To install OpenSSL, execute the command:

• Astra Linux and ALT Linux:

sudo apt-get install openssl

• Rocky Linux:

sudo yum install openssl

• RED OS:

sudo dnf install openssl

To support the work with GOST encryption algorithms, the libraries are installed by default: libgost-astra in Debian-based distributions, openssl-gost-engine in RedHat-based distributions and ALT Linux.

To get the private key of the server certificate and the server certificate:

1. Create the /opt/foresight/ssl directory and open it:

cd /opt/foresight/ssl

2. Generate the private key of the server certificate:

openssl genpkey -algorithm gost2012_256 -pkeyopt paramset:A -out fp_key_gost.pem

3. Create a request to issue the certificate:

openssl req -key fp_key_gost.pem -new -out domain.csr

NOTE. When creating a request,specify DNS name of the server, on which web application back end is installed, in the CN parameter.

4. Send the contents of the obtained request domain.csr without headers to the certification service. To do this, execute the operations in the CryptoPro test certificate authority:

1. Select the Submit a Ready PKCS#10 or PKCS#7 Request Encoded in Base64 option. After this the Submit a Certificate Request or Renewal Request page opens.

2. Copy the contents of the request domain.csr without headers and paste to the Saved Request box.

3. Click the Issue button.

5. Save the obtained server certificate named fp_server_gost in the /opt/foresight/ssl directory.

After executing the operations the /opt/foresight/ssl directory will contain the following: the private key of the server certificate fp_key_gost.pem and the fp_server_gost.cer server certificate that uses GOST encryption algorithms.

If it is assumed to set up two-factor authentication, also get the fp_ca_gost.cer root certificate and the client_gost.pfx client certificate.

Get root certificate

Get client certificate

Step 2. Setting Up BI Server and Web Application Back End

To set up BI server and web application back end:

1. Specify DNS name of the server that was set at the Step 1 and add SSL parameters:

• In the <VirtualHost *:8810> section of the configuration file on the Apache2 web server, on which the BI server is installed:

• /etc/apache2-fp10.x/mods-available/fp10.x-biserver.conf in Debian-based distributions.

• /etc/httpd-fp10.x/conf.d/fp10.x-biserver.conf in RedHat-based distributions.

• /etc/httpd2-fp10.x/conf/mods-enabled/fp10.x-biserver.conf in ALT Linux.

• In the <VirtualHost *:8110> section of the configuration file of the Apache2 web server instance, on which the web application back end is installed:

• /etc/apache2-fp10.x-web/sites-available/webserver.conf in Debian-based distributions.

• /etc/httpd-fp10.x-web/conf.d/00-virtualhost.conf in RedHat-based distributions.

• /etc/httpd2-fp10.x-web/conf/sites-enabled/000-default.conf in ALT Linux.

ServerName <DNS name of the server>
SSLCertificateFile /opt/foresight/ssl/fp_server_gost.cer
SSLCertificateKeyFile /opt/foresight/ssl/fp_key_gost.pem
SSLHonorCipherOrder on
SSLProtocol TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite GOST2012-GOST8912-GOST8912:GOST2001-GOST89-GOST89

2. Restart the BI server and web application back end

After executing the operations, the BI server and web application back end are set up.

Step 3. Installing Chromium GOST Browser

To install Chromium GOST browser:

1. Download the Chromium GOST browser distribution at the official CryptoPro website and place it in the /home/<user name> home directory:

• chromium-gost*.deb for Debian-based distributions.

• chromium-gost*.rpm for RedHat-based distributions and ALT Linux.

2. Change the current directory with the distribution:

cd /home/<user name>

3. Install the Chromium GOST browser distribution:

• Astra Linux:

sudo dpkg -i chromium-gost*.deb

• Rocky Linux:

sudo yum localinstall chromium-gost*.rpm

• RED OS:

sudo dnf install chromium-gost*.rpm

• ALT Linux:

sudo apt-get install -y chromium-gost*.rpm

4. Open the browser and make sure that the CryptoPro Extension for CAdES Browser Plug-in and Extension for CAdES Browser Plug-in plugins are installed and enabled that are included in the CryptoPro ECP Browser plug-in.

After executing the operations the Chromium GOST browser is installed.

Step 4. Opening Web Application via the HTTPS Protocol

To open web application via the HTTPS protocol, specify the URL in the connection string:

https://<web server>:<port number>/fp10.x/r/

Where:

• <web server>. DNS name of the server, on which web application back end is installed.

• <port number>. Number of the port, at which web application back end is available. The 443 port is used by default.

NOTE. As a result of setting up web application work in the Chromium-Gost browser, the 8110 port should be used instead of 443.