StartSSL Free Certificate - Revision history

Leo at 06:23, 1 September 2019

2019-09-01T06:23:42Z

← Older revision		Revision as of 06:23, 1 September 2019
Line 108:		Line 108:
	{{Navbox Linux}}[[Category:Linux]]		{{Navbox Linux}}[[Category:Linux]]
	[[Category:Deprecated]]		[[Category:Deprecated]]
			{{Navbox Certificates}}[[Category:Certificates]]

Leo: Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

2019-09-01T06:22:18Z

Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

← Older revision		Revision as of 06:22, 1 September 2019
Line 106:		Line 106:
	}}		}}

	[[Category:Linux]]~~{{Navbox Linux}}~~		{{Navbox Linux}}[[Category:Linux]]
	[[Category:Deprecated]]		[[Category:Deprecated]]

Leo: Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

2019-09-01T05:11:26Z

Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

← Older revision		Revision as of 05:11, 1 September 2019
Line 106:		Line 106:
	}}		}}

	[[Category:Linux]]~~{{Navbox Linux}}~~{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}
	[[Category:Deprecated]]		[[Category:Deprecated]]

Leo: Text replacement - "Category:Linux" to "Category:Linux{{Navbox Linux}}"

2019-09-01T05:08:00Z

Text replacement - "Category:Linux" to "Category:Linux{{Navbox Linux}}"

← Older revision		Revision as of 05:08, 1 September 2019
Line 106:		Line 106:
	}}		}}

	[[Category:Linux]]{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}{{Navbox Linux}}
	[[Category:Deprecated]]		[[Category:Deprecated]]

Leo: deprecated

2019-09-01T03:58:36Z

deprecated

← Older revision		Revision as of 03:58, 1 September 2019
Line 1:		Line 1:
			{{Warning
			\|1=Deprecated Information!
			\|2=StartSSL no longer provides free SSL certificates as of January 1st, 2018. Use Let's Encrypt instead.
			}}

	StartSSL provides free SSL certificates (StartSSL Free) which is a great alternative to self-signed certificates. The only restrictions with StartSSL Free is that:		StartSSL provides free SSL certificates (StartSSL Free) which is a great alternative to self-signed certificates. The only restrictions with StartSSL Free is that:
Line 16:		Line 20:
	== Requesting a Server Certificate ==		== Requesting a Server Certificate ==
	Generate a certificate signing request by running:		Generate a certificate signing request by running:
	cd ~		{{highlight\|lang=terminal\|code=
	mkdir ssl		# cd ~
	openssl genrsa -des3 -out steamr.com.key 4096		# mkdir ssl
	openssl req -new -key steamr.com.key -out steamr.com.csr		# openssl genrsa -des3 -out steamr.com.key 4096
			# openssl req -new -key steamr.com.key -out steamr.com.csr
			}}

	As part of your key generation process, you may enter any passphrase. (We can create an 'insecure' key without the passphrase later once the certificate is signed) The steps above will create a .key and a .csr file.		As part of your key generation process, you may enter any passphrase. (We can create an 'insecure' key without the passphrase later once the certificate is signed) The steps above will create a .key and a .csr file.
Line 50:		Line 56:
	=== Certificate Chain ===		=== Certificate Chain ===
	With the five files listed above, you will need to combine the intermediate / root CA certificate into a chain certificate:		With the five files listed above, you will need to combine the intermediate / root CA certificate into a chain certificate:
	cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt		{{highlight\|lang=terminal\|code=
			# cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt
			}}

	You will need to combine your private/certificate and the certificate chain above:		You will need to combine your private/certificate and the certificate chain above:
	cat steamr.com.crt steamr.com.key startssl.chain.class1.server.crt > steamr.com.pem		{{highlight\|lang=terminal\|code=
	mv steamr.com.pem /etc/pki/tls/cert.pem		# cat steamr.com.crt steamr.com.key startssl.chain.class1.server.crt > steamr.com.pem
			# mv steamr.com.pem /etc/pki/tls/cert.pem
			}}

	=== Installing Certificates ===		=== Installing Certificates ===
Line 67:		Line 77:
	# steamr.com.key		# steamr.com.key

	~~Chmod~~ the key to 600.		chmod the key to 600.

	=== Enable Apache SSL ===		=== Enable Apache SSL ===

	Edit your Apache SSL config, ensuring that you have at least the following lines:		Edit your Apache SSL config, ensuring that you have at least the following lines:
			{{highlight\|lang=text\|code=
	SSLEngine On		# SSLEngine On
	SSLCertificateFile /etc/pki/tls/certs/steamr.com.crt		# SSLCertificateFile /etc/pki/tls/certs/steamr.com.crt
	SSLCertificateKeyFile /etc/pki/tls/private/steamr.com.key		# SSLCertificateKeyFile /etc/pki/tls/private/steamr.com.key
	SSLCertificateChainFile /etc/pki/tls/certs/startssl.chain.class1.server.crt		# SSLCertificateChainFile /etc/pki/tls/certs/startssl.chain.class1.server.crt
			}}

	Configure your virtual hosts as needed, and reload/restart apache.		Configure your virtual hosts as needed, and reload/restart apache.
Line 82:		Line 93:
	== Removing Passphrase from Certificate ==		== Removing Passphrase from Certificate ==
	If you had entered a passphrase as part of the certificate creation process, you may remove it (such that restarting apache won't prompt you for a paassword) by:		If you had entered a passphrase as part of the certificate creation process, you may remove it (such that restarting apache won't prompt you for a paassword) by:
			{{highlight\|lang=terminal\|code=
	cd /etc/pki/tls/private		# cd /etc/pki/tls/private
	openssl rsa -in steamr.com.key -out steamr.com.key.insecure		# openssl rsa -in steamr.com.key -out steamr.com.key.insecure
	mv steamr.out.key.insecure steamr.com.key		# mv steamr.out.key.insecure steamr.com.key
	chmod 600 *.key		# chmod 600 *.key
			}}
	== Troubleshooting ==		== Troubleshooting ==
	=== Verifying SSL Certificates ===		=== Verifying SSL Certificates ===
	You may test out whether you have set apache up properly by checking the certificates manually:		You may test out whether you have set apache up properly by checking the certificates manually:
	echo HEAD / \| openssl s_client -connect localhost:443 -quiet > /dev/null		{{highlight\|lang=terminal\|code=
			# echo HEAD / \| openssl s_client -connect localhost:443 -quiet > /dev/null
			}}

	[[Category:Linux]]{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}
	[[Category:~~Guides~~]]		[[Category:Deprecated]]

Leo: Text replacement - "Category:Linux " to "Category:Linux{{Navbox Linux}} "

2019-09-01T03:55:45Z

Text replacement - "Category:Linux " to "Category:Linux{{Navbox Linux}} "

← Older revision		Revision as of 03:55, 1 September 2019
Line 93:		Line 93:
	echo HEAD / \| openssl s_client -connect localhost:443 -quiet > /dev/null		echo HEAD / \| openssl s_client -connect localhost:443 -quiet > /dev/null

	[[Category:Linux]]		[[Category:Linux]]{{Navbox Linux}}
	[[Category:Guides]]		[[Category:Guides]]

Leo: Text replacement - "" to "}}"

2017-02-24T19:14:55Z

Text replacement - "</code>" to "}}"

← Older revision		Revision as of 19:14, 24 February 2017
Line 57:		Line 57:

	=== Installing Certificates ===		=== Installing Certificates ===
	Copy the following 2 certificate files to {{code\|/etc/pki/tls/certs~~</code>~~ (Assuming you're on RedHat based distros. This location may vary):		Copy the following 2 certificate files to {{code\|/etc/pki/tls/certs}} (Assuming you're on RedHat based distros. This location may vary):
	# startssl.chaina.class1.server.crt		# startssl.chaina.class1.server.crt
	# steamr.com.crt		# steamr.com.crt
Line 64:		Line 64:

	=== Installing Private Key ===		=== Installing Private Key ===
	Copy the private key to {{code\|/etc/pki/tls/private~~</code>~~		Copy the private key to {{code\|/etc/pki/tls/private}}
	# steamr.com.key		# steamr.com.key

Leo: Text replacement - "`" to "{{code|"`


2017-02-24T19:13:26Z
Text replacement - "<code>" to "{{code|"

				
				
				
				
				
				← Older revision
				Revision as of 19:13, 24 February 2017
				
Line 57:
Line 57:



=== Installing Certificates === === Installing Certificates ===
Copy the following 2 certificate files to <code>/etc/pki/tls/certs</code> (Assuming you're on RedHat based distros. This location may vary): Copy the following 2 certificate files to {{code|/etc/pki/tls/certs</code> (Assuming you're on RedHat based distros. This location may vary):
# startssl.chaina.class1.server.crt # startssl.chaina.class1.server.crt
# steamr.com.crt # steamr.com.crt
Line 64:
Line 64:



=== Installing Private Key === === Installing Private Key ===
Copy the private key to <code>/etc/pki/tls/private</code> Copy the private key to {{code|/etc/pki/tls/private</code>
# steamr.com.key # steamr.com.key



Leo: /* Certificate Chain */
2013-06-24T07:14:02Z
Certificate Chain

				
				
				
				
				
				← Older revision
				Revision as of 07:14, 24 June 2013
				
Line 52:
Line 52:
  cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt   cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt



You will also need to append this chain to the root certs file as well at <code>/etc/pki/tls/cert.pem</code>. You will need to combine your private/certificate and the certificate chain above:
  cat startssl.chain.class1.server.crt > /etc/pki/tls/cert.pem   cat steamr.com.crt steamr.com.key startssl.chain.class1.server.crt > steamr.com.pem
 mv steamr.com.pem /etc/pki/tls/cert.pem



=== Installing Certificates === === Installing Certificates ===





Leo: /* Installing Server Certificate */
2013-06-24T07:10:19Z
Installing Server Certificate

				
				
				
				
				
				← Older revision
				Revision as of 07:10, 24 June 2013
				
Line 48:
Line 48:
# Toolbox -> StartCom CA Certificates -> Class 1 Intermediate Server CA # Toolbox -> StartCom CA Certificates -> Class 1 Intermediate Server CA



=== Certificate Chain ===
With the five files listed above, you will need to combine the intermediate / root CA certificate into a chain certificate: With the five files listed above, you will need to combine the intermediate / root CA certificate into a chain certificate:
  cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt   cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt



You will also need to append this chain to the root certs file as well at <code>/etc/pki/tls/cert.pem</code>.
 cat startssl.chain.class1.server.crt > /etc/pki/tls/cert.pem

=== Installing Certificates ===
Copy the following 2 certificate files to <code>/etc/pki/tls/certs</code> (Assuming you're on RedHat based distros. This location may vary): Copy the following 2 certificate files to <code>/etc/pki/tls/certs</code> (Assuming you're on RedHat based distros. This location may vary):
# startssl.chaina.class1.server.crt # startssl.chaina.class1.server.crt
Line 57:
Line 62:
Chmod the certificates to 640. Chmod the certificates to 640.



=== Installing Private Key ===
Copy the private key to <code>/etc/pki/tls/private</code> Copy the private key to <code>/etc/pki/tls/private</code>
# steamr.com.key # steamr.com.key



Chmod the key to 600. Chmod the key to 600.

=== Enable Apache SSL ===



Edit your Apache SSL config, ensuring that you have at least the following lines: Edit your Apache SSL config, ensuring that you have at least the following lines:

← Older revision		Revision as of 19:13, 24 February 2017
Line 57:		Line 57:

	=== Installing Certificates ===		=== Installing Certificates ===
	Copy the following 2 certificate files to <code>/etc/pki/tls/certs</code> (Assuming you're on RedHat based distros. This location may vary):		Copy the following 2 certificate files to {{code\|/etc/pki/tls/certs</code> (Assuming you're on RedHat based distros. This location may vary):
	# startssl.chaina.class1.server.crt		# startssl.chaina.class1.server.crt
	# steamr.com.crt		# steamr.com.crt
Line 64:		Line 64:

	=== Installing Private Key ===		=== Installing Private Key ===
	Copy the private key to <code>/etc/pki/tls/private</code>		Copy the private key to {{code\|/etc/pki/tls/private</code>
	# steamr.com.key		# steamr.com.key

← Older revision		Revision as of 07:14, 24 June 2013
Line 52:		Line 52:
	cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt		cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt

	You will ~~also~~ need to ~~append this~~ chain ~~to the root certs file as well at <code>/etc/pki/tls/cert.pem</code>.~~		You will need to combine your private/certificate and the certificate chain above:
	cat startssl.chain.class1.server.crt > /etc/pki/tls/cert.pem		cat steamr.com.crt steamr.com.key startssl.chain.class1.server.crt > steamr.com.pem
			mv steamr.com.pem /etc/pki/tls/cert.pem

	=== Installing Certificates ===		=== Installing Certificates ===

← Older revision		Revision as of 07:10, 24 June 2013
Line 48:		Line 48:
	# Toolbox -> StartCom CA Certificates -> Class 1 Intermediate Server CA		# Toolbox -> StartCom CA Certificates -> Class 1 Intermediate Server CA

			=== Certificate Chain ===
	With the five files listed above, you will need to combine the intermediate / root CA certificate into a chain certificate:		With the five files listed above, you will need to combine the intermediate / root CA certificate into a chain certificate:
	cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt		cat ca.pem sub.class1.server.ca.pem > startssl.chain.class1.server.crt

			You will also need to append this chain to the root certs file as well at <code>/etc/pki/tls/cert.pem</code>.
			cat startssl.chain.class1.server.crt > /etc/pki/tls/cert.pem

			=== Installing Certificates ===
	Copy the following 2 certificate files to <code>/etc/pki/tls/certs</code> (Assuming you're on RedHat based distros. This location may vary):		Copy the following 2 certificate files to <code>/etc/pki/tls/certs</code> (Assuming you're on RedHat based distros. This location may vary):
	# startssl.chaina.class1.server.crt		# startssl.chaina.class1.server.crt
Line 57:		Line 62:
	Chmod the certificates to 640.		Chmod the certificates to 640.

			=== Installing Private Key ===
	Copy the private key to <code>/etc/pki/tls/private</code>		Copy the private key to <code>/etc/pki/tls/private</code>
	# steamr.com.key		# steamr.com.key

	Chmod the key to 600.		Chmod the key to 600.

			=== Enable Apache SSL ===

	Edit your Apache SSL config, ensuring that you have at least the following lines:		Edit your Apache SSL config, ensuring that you have at least the following lines: