creating a ssl certificate
magnet November 6th, 2008
- A little tutorial on creating an SSl certificate, you can also generate your own self signed certificate:-
1) The first step is to create your RSA Private Key. This key is a 4096 bit RSA key which is encrypted using Triple-DES and stored in a PEM format so that it is readable as ASCII text.
>> openssl genrsa -des3 -out domainname.com.key 4096
Once you run the above command, it will ask you to enter a Pass phrase for your domain key file.
2) Generating a CSR (Certificate signing request) :-
Once the private key is generated a Certificate Signing Request can be generated. The CSR is then used in one of two ways. Ideally, the CSR will be sent to a Certificate Authority, such as Thawte or Verisign who will verify the identity of the requestor and issue a signed certificate. or you can use it to create your own self signed certificate for intranets or for demo purpose.
These are the X.509 attributes of the certificate. One of the prompts will be for “Common Name (e.g., YOUR name)”. It is important that this field be filled in with the fully qualified domain name of the server to be protected by SSL. If the website to be protected will be https://domainname.com, then enter domainname.com at this prompt. If you want to create a so called “wildcard” certificate, which means the same certificate can be used on an unlimited number of subdomains, just enter an asterisk as the hostname, in our example that would be *.domainname.com.
>> openssl req -new -key domainname.com.key -out domainname.com.csr
Once the above command is run, it will ask you the following set of questions :
Enter pass phrase for domainname.com.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:
Email Address []:
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
3) Removing the Pass phrase from the key :-
One unfortunate side-effect of the pass-phrased private key is that Apache will ask for the pass-phrase each time the web server is started. Obviously this is not necessarily convenient as someone will not always be around to type in the pass-phrase, such as after a reboot or crash. mod_ssl includes the ability to use an external program in place of the built-in pass-phrase dialog, however, this is not necessarily the most secure option either. It is possible to remove the Triple-DES encryption from the key, thereby no longer needing to type in a pass-phrase. If the private key is no longer encrypted, it is critical that this file only be readable by the root user! If your system is ever compromised and a third party obtains your unencrypted private key, the corresponding certificate will need to be revoked. With that being said, use the following command to remove the pass-phrase from the key:
>> cat domainname.com.key >domainname.com.key.orig
>> openssl rsa -in domainname.com.key -out domainname.com.key
* Once you have geerated the csr file , you can provide the csr file which you can send to the certificate authority like thawte or verizon for verification and they will verify and issue the signed certificate which you can apply on your domain in apache you can also use the certificate for your smtp, pop , imap and ftp. You can also have a free signed certificate from http://cacert.org, they will verify and issue you the signed certificate.
If you want to generate your own self signed certificate to use in an intranet or for demo, then move ahead to the next step :
4) Generating a Self-signed certificate :
This temporary certificate will generate an error in the client browser to the effect that the signing certificate authority is unknown and not trusted.
>> openssl x509 -req -days 365 -in domainname.com.csr -signkey domainname.com.key -out domainname.com.crt
Now you have generated your own self signed certificate, you need to have the mod_ssl module in your Apache.
You need to make entries in your apache config file too enable the website to be working with https://
it would httpd.conf or apache.conf file depending upon the Linux distributing you are using.
Also you can refer to the following blogs and sites which were helpful for me to knoe about the ssl and also able to intall the ssl certificate for my website :
www.yatblog.com/2007/02/27/how-to-create-a-s
www.tc.umn.edu/~brams006/selfsign.html
www.geotrusteurope.com/support/csr/csr_a
And for any one trying to install apache with SSL on a ubuntu gutsy or fiesty like i was trying to, refer to the following URL :
help.ubuntu.com/community/forum/server/a
Hope this little article was helpful.
Thank you
Systems Team