Self Signed SSL Certificates - Revision history

Leo: Reverted edits by 174.241.28.194 (talk) to last revision by Leo

2022-02-07T02:39:31Z

Reverted edits by 174.241.28.194 (talk) to last revision by Leo

← Older revision		Revision as of 02:39, 7 February 2022
Line 82:		Line 82:

	== See Also ==		== See Also ==
	* [[OpenSSL]-most-common-openssl-commands.html		* [[OpenSSL]]
			* https://www.sslshopper.com/article-most-common-openssl-commands.html

	}}		{{Navbox Linux}}[[Category:Linux]]
			[[Category:Certificates]]{{Navbox Certificates}}

174.241.28.194: /* See Also */

2022-02-06T21:51:59Z

Leo at 06:21, 1 September 2019

2019-09-01T06:21:15Z

← Older revision		Revision as of 06:21, 1 September 2019
Line 86:		Line 86:

	{{Navbox Linux}}[[Category:Linux]]		{{Navbox Linux}}[[Category:Linux]]
			[[Category:Certificates]]{{Navbox Certificates}}

Leo: Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

2019-09-01T06:20:58Z

Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

← Older revision		Revision as of 06:20, 1 September 2019
Line 85:		Line 85:
	* https://www.sslshopper.com/article-most-common-openssl-commands.html		* https://www.sslshopper.com/article-most-common-openssl-commands.html

	[[Category:Linux]]~~{{Navbox Linux}}~~		{{Navbox Linux}}[[Category:Linux]]

Leo: Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

2019-09-01T05:10:43Z

Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

← Older revision		Revision as of 05:10, 1 September 2019
Line 85:		Line 85:
	* https://www.sslshopper.com/article-most-common-openssl-commands.html		* https://www.sslshopper.com/article-most-common-openssl-commands.html

	[[Category:Linux]]~~{{Navbox Linux}}~~{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}

Leo: Text replacement - "Category:Linux" to "Category:Linux{{Navbox Linux}}"

2019-09-01T05:09:32Z

Text replacement - "Category:Linux" to "Category:Linux{{Navbox Linux}}"

← Older revision		Revision as of 05:09, 1 September 2019
Line 85:		Line 85:
	* https://www.sslshopper.com/article-most-common-openssl-commands.html		* https://www.sslshopper.com/article-most-common-openssl-commands.html

	[[Category:Linux]]{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}{{Navbox Linux}}

Leo: navbox and recategorize

2019-09-01T04:21:24Z

navbox and recategorize

← Older revision		Revision as of 04:21, 1 September 2019
Line 84:		Line 84:
	* [[OpenSSL]]		* [[OpenSSL]]
	* https://www.sslshopper.com/article-most-common-openssl-commands.html		* https://www.sslshopper.com/article-most-common-openssl-commands.html

			[[Category:Linux]]{{Navbox Linux}}

Leo: added back information on how to self sign a certificate

2019-09-01T04:20:49Z

added back information on how to self sign a certificate

← Older revision		Revision as of 04:20, 1 September 2019
Line 1:		Line 1:
	~~__NOTOC__~~		Self signed SSL certificates can be generated using [[OpenSSL]].
	Self-signed SSL certificates can be ~~used to set up a temporary or personal SSL web server~~. ~~It may be useful in cases where you don't want to spend money for security or if you distrust all certificate authorities~~

	~~To quickly generate~~ a ~~self~~-~~signed certificate, enter~~ a ~~domain name below and follow the instructions:~~		== Steps ==
	~~<htmlet nocache="yes">selfsignedssl~~-~~js</htmlet>~~		=== Private Key ===
			Generate a new private key. The output will be a Privacy-Enhanced Mail (PEM) format.
			{{highlight\|lang=terminal\|code=
			## Generate a new private key
			# openssl genrsa -out server.key 4096
			}}

			=== Certificate Signing Request ===
			Generate the certificate signing request.
			{{highlight\|lang=terminal\|code=
			# openssl req -new -sha256 \
			-key server.key \
			-subj "/C=CA/ST=Alberta/O=Steamr/CN=steamr.com" \
			-reqexts SAN \
			-extensions SAN \
			-config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:x.steamr.com,DNS:y.steamr.com")) \
			-out server.csr
			}}

	~~Run the following commands on a *NIX machine with OpenSSL installed~~:		The {{code\|-subj}} value contains:
	~~<htmlet nocache~~="~~yes~~"~~>selfsignedssl~~-~~cmd</htmlet>~~		{\| class="wikitable"
			! Field !! Description !! Example
			\|-
			\| C \|\| Country - The 2 letter International Standards Organization ISO abbreviation for your country \|\| CA
			\|-
			\| ST \|\| State - The state or province of your organization \|\| Alberta
			\|-
			\| O \|\| Organization - The legal name of the organization \|\| Steamr Corp.
			\|-
			\| CN \|\| Common Name - The fully qualified domain name for the certificate \|\| steamr.com
			\|}

	~~To configure apache to use~~ the ~~newly created key and SSL certificate, create a new~~ {{code\|~~VirtualHost~~}} ~~with~~ the ~~configuration below:~~		Additionally, the {{code\|[SAN]}} section passed in through the {{code\|-config}} flag is used to define any SANs the certificate should have and can be removed if unneeded.
	~~<htmlet nocache="yes">selfsignedssl~~-~~apache</htmlet>~~

	==~~= Explaination ===~~		You can verify your CSR using:
			{{highlight\|lang=terminal\|code=
			# openssl req -noout -text -in server.csr
			}}

	~~== Renewing an Expired Self Signed Certificate ==~~		After you have verified your CSR, you can either continue to self sign with the next step, or submit it to a CA to purchase a SSL certificate.
	~~You~~ can ~~check~~ the ~~status of~~ a certificate ~~using:~~
	~~openssl x509 -in cert~~.~~crt -text -noout~~

	~~If it has expired, you can 'renew' it by first regenerating a~~ certificate signing request (~~CSR~~):		=== Signing ===
	~~openssl x509~~ -~~x509toreq~~ -in ~~expired_certificate~~.~~crt~~ -out ~~new_csr~~.~~csr~~ -~~signkey domain_private~~.~~key~~		Sign your certificate signing request.
			{{highlight\|lang=terminal\|code=
			# openssl x509 \
			-req \
			-days 730 \
			-extfile <(printf "subjectAltName=DNS:x.steamr.com,DNS:y.steamr.com") \
			-signkey server.key \
			-in server.csr \
			-out server.crt
			}}
			The {{code\|-days}} value defines the number of days the certificate will be valid for from the time of signing. If not given, a default of 30 days will be used.

	~~Then signing~~ the ~~CSR with the private key to produce a new certificate:~~		Any SANs will also need to be passed through using the {{code\|-extfile}} flag.
	~~openssl x509 -req -days 3650 -in new_csr.csr -signkey domain_private.key~~ -~~out new_certificate~~.~~crt~~

	~~Replace~~ the ~~expired~~ certificate ~~with the new certificate and reload any services that are using the certificate for it to be applied~~.		You can verify the signed certificate by running:
			{{highlight\|lang=terminal\|code=
			# openssl x509 -noout -text -in server.crt
			}}

	== ~~Trusting Your Self Signed SSL Certificates~~ ==		=== Renewing ===
	~~The key and~~ certificate ~~generated with the steps above will not be signed~~ by a ~~trusted~~ certificate ~~authority and therefore cannot be verified by your browser, resulting in a security warning.~~		If the certificate has expired, you can 'renew' it by first regenerating a certificate signing request (CSR):

			{{highlight\|lang=terminal\|code=
			# openssl x509 -x509toreq -in expired_certificate.crt -out new_csr.csr -signkey domain_private.key
			}}

	== ~~Other Notes ==~~		Then signing the CSR with the private key to produce a new certificate:
			{{highlight\|lang=terminal\|code=
			# openssl x509 -req -days 3650 -in new_csr.csr -signkey domain_private.key -out new_certificate.crt
			}}

	~~Note: Ensure~~ that ~~all keys~~ are ~~not readable~~ to ~~others. chmod 700 the ssl directory and chmod 600 all the keys~~.		Replace the expired certificate with the new certificate and reload any services that are using the certificate for it to be applied.

	~~openssl req -new -x509 -key www.example.com.~~key ~~-out www.example.com.cert -days 3650 -subj /CN=www~~.~~example~~.~~com~~		== Trusting Your Self Signed SSL Certificates ==
			The key and certificate generated with the steps above will not be signed by a trusted certificate authority and therefore cannot be verified by your browser, resulting in a security warning. To get around this, you can add your certificate directly into your browser or operating system's list of trusted certificate authorities.

Leo: Text replacement - "" to "}}"

2017-02-24T19:14:53Z

Text replacement - "</code>" to "}}"

← Older revision		Revision as of 19:14, 24 February 2017
Line 9:		Line 9:
	<htmlet nocache="yes">selfsignedssl-cmd</htmlet>		<htmlet nocache="yes">selfsignedssl-cmd</htmlet>

	To configure apache to use the newly created key and SSL certificate, create a new {{code\|VirtualHost~~</code>~~ with the configuration below:		To configure apache to use the newly created key and SSL certificate, create a new {{code\|VirtualHost}} with the configuration below:
	<htmlet nocache="yes">selfsignedssl-apache</htmlet>		<htmlet nocache="yes">selfsignedssl-apache</htmlet>

Leo: Text replacement - "`" to "{{code|"`


2017-02-24T19:13:23Z
Text replacement - "<code>" to "{{code|"

				
				
				
				
				
				← Older revision
				Revision as of 19:13, 24 February 2017
				
Line 9:
Line 9:
<htmlet nocache="yes">selfsignedssl-cmd</htmlet> <htmlet nocache="yes">selfsignedssl-cmd</htmlet>



To configure apache to use the newly created key and SSL certificate, create a new <code>VirtualHost</code> with the configuration below: To configure apache to use the newly created key and SSL certificate, create a new {{code|VirtualHost</code> with the configuration below:
<htmlet nocache="yes">selfsignedssl-apache</htmlet> <htmlet nocache="yes">selfsignedssl-apache</htmlet>

← Older revision		Revision as of 21:51, 6 February 2022
Line 82:		Line 82:

	== See Also ==		== See Also ==
	* [[OpenSSL]]		* [[OpenSSL]-most-common-openssl-commands.html
	* https://www.sslshopper.com/article-most-common-openssl-commands.html

	~~{{Navbox Linux}}[[Category:Linux]]~~		}}
	~~[[Category:Certificates]]{{Navbox Certificates~~}}

← Older revision		Revision as of 19:13, 24 February 2017
Line 9:		Line 9:
	<htmlet nocache="yes">selfsignedssl-cmd</htmlet>		<htmlet nocache="yes">selfsignedssl-cmd</htmlet>

	To configure apache to use the newly created key and SSL certificate, create a new <code>VirtualHost</code> with the configuration below:		To configure apache to use the newly created key and SSL certificate, create a new {{code\|VirtualHost</code> with the configuration below:
	<htmlet nocache="yes">selfsignedssl-apache</htmlet>		<htmlet nocache="yes">selfsignedssl-apache</htmlet>