Difference between revisions of "CSR Apache"
m |
m |
||
| Line 1: | Line 1: | ||
| − | |||
| − | |||
| − | There are two | + | There are two types of SSL certificates: certificates signed by a Certificate Authority (CA) and self-signed certificates (Snakeoil Certs). Neither one is cryptographically stronger than the other. In other words, a snakeoil cert is <b>not</b> less secure or easier to break. If you are simply want to secure your own private web server |
| + | then a Snakeoil cert is fine. | ||
| − | For more information | + | For more information see: |
| − | http://www.openssl.org | + | [http://httpd.apache.org/docs/2.0/ssl/ Apache2 SSL] |
| + | [http://www.openssl.org OpenSSL] | ||
== generate a private server key == | == generate a private server key == | ||
| Line 49: | Line 49: | ||
== Generating a Self-Signed Certificate == | == Generating a Self-Signed Certificate == | ||
| − | + | foo | |
| − | + | == Cert Installation == | |
| − | + | Some systems such as security appliances (load balancers, hardware SSL) will want your SSL Cert as a single file. The Coyote Point Equalizer is like this. You can combine your server.key and server.crt files into a single file simply by concatinating them together. They are plain text files. | |
| − | + | <pre> | |
| − | + | cat server.key server.csr > server.pem | |
| − | + | </pre> | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | This also works on Apache2. | |
| − | |||
Revision as of 15:55, 16 August 2006
There are two types of SSL certificates: certificates signed by a Certificate Authority (CA) and self-signed certificates (Snakeoil Certs). Neither one is cryptographically stronger than the other. In other words, a snakeoil cert is not less secure or easier to break. If you are simply want to secure your own private web server then a Snakeoil cert is fine.
For more information see:
Apache2 SSL OpenSSL
Contents
generate a private server key
1. Enter the following command:
openssl genrsa -out server.key 1024
generate a CA-signed certificate
A Certificate Authority such as Thawte or Verisign verifies certificates. You have to subscribe to this service. It does not improve the crypto security. A CA merely lets your customers know that you are who you say you are.
First you have to generate a Certificate Signing Request (CSR) to give to a CA to obtain a CA-signed certificate:
1. Enter the following command:
openssl req -new -key server.key -out server.csr
2. You will be presented with a form to fill out. It's pretty simple. Just make sure that when you are asked for your "Common Name" that you enter your Fully Qualified Domain Name (FQDN) and that it exactly matches the domain name of your server. That includes the www in www.example.com. For example:
Common Name (eg, YOUR name) []: www.example.com
The certificate is generated and stored in the file server.crt.
3. OPTIONAL -- Encrypt the key to prevent the key from being compromised. This will require that you enter your key password everytime you start your web server. This means that you cannot have the server start automatically when the machine boots. I almost never do this.
openssl rsa -des3 -in server.key -out server.key.crypt
4. Make sure that no one can read your private server.key.
chmod 400 server.key
5. Submit the CSR to your CA. The CA will provide instructions on how to submit the CSR. Usually you have to paste it into a form on a web page. Once the CSR is processed, the CA will mail you a signed certificate.
6. Store the CA-signed certificate in the file server.crt.
7. Make sure that everyone can read you server.crt:
chmod 444 server.crt
Generating a Self-Signed Certificate
foo
Cert Installation
Some systems such as security appliances (load balancers, hardware SSL) will want your SSL Cert as a single file. The Coyote Point Equalizer is like this. You can combine your server.key and server.crt files into a single file simply by concatinating them together. They are plain text files.
cat server.key server.csr > server.pem
This also works on Apache2.
