Changes between Initial Version and Version 1 of APACHE_ssl_cert_req

Timestamp:

12/05/14 11:46:17 (12 years ago)

Author:

lttoth@…

Comment:

--

APACHE_ssl_cert_req

@@ +1 @@
+= Generating a Certificate Signing Request for Apache entry =   
+    Original author:  Beth Mercer - 2007/04/12
+
+== Apache/SSL installation == 
+
+For a general overviews of installation see also: 
+ * [[https://www.sslshopper.com/apache-server-ssl-installation-instructions.html| Apache SSL Installation]]
+ * [[https://www.digicert.com/ssl-certificate-installation-apache.htm| Apache SSL Certificate Installation]]
+
+=== Create a RSA private key and certificate request for your Apache server ===
+ 1. Change to the target certification location
+{{{
+    $ cd [some private directory with strict permissions]
+}}}
+ 1. Generate a private key, place it in PEM-format file sec-server.key which is encrypted and password-protected by a passphrase for which you will be prompted.
+{{{
+    $ /usr/local/ssl/bin/openssl genrsa -des3 -out sec-server.key 1024
+}}}
+ 1. Decrypt the contents of sec-server.key into server.key
+{{{
+   $ /usr/local/ssl/bin/openssl rsa -in sec-server.key -out server.key
+}}}
+ 1. Create Certificate Signing Request using decrypted private key.
+{{{
+   $ /usr/local/ssl/bin/openssl req -new -key server.key -out server.csr
+   $ mailx -s "Certificate Signing Request" sxccc@alaska.edu < server.csr
+}}}
+ 1. As root (sudo or su)
+{{{
+   $ su
+   $ chown root:root server.key sec-server.key
+   $ chmod 0400 server.key sec-server.key server.csr
+   $ cp -p server.key [installed apache dir]/conf/ssl.key
+   $ cp -p server.csr [installed apache dir]/conf/ssl.csr
+}}}
+     * In Solaris 10, the directory structure is somewhat different:
+  {{{
+      $ mkdir ssl.crt
+      $ cp -p server.key /etc/
+  }}}
+=== Install the Certificate ===
+  After your certificate request is signed and a signed server
+   certificate is returned, put the signed server certificate in server.crt.
+{{{
+    $ chmod 0400 server.crt
+    $ cp -p server.crt [installed apache dir]/conf/ssl.crt
+}}}
+
+In the example below, the private key had already been generated for the
+edirtest and edirprep entries, so I skipped the two commands "openssl
+genrsa..."  and "openssl rsa...".  An old certificate exists, but the previous
+CSR has been lost and thus I can not just RENEW the exiting certificate.  I
+need to generate a new HCF certificate, so I needed to submit a new CSR.
+
+{{{
+eklutna.root> pwd
+/usr/local/Apache/ssl-certs
+
+eklutna.root> ls -l edir+(prep|test)*
+-r--------   1 root     other       2948 Nov 22  2005 edirprep.crt
+-r--------   1 root     other        891 Nov 22  2005 edirprep_private.key
+-r--------   1 root     other       2948 Nov 22  2005 edirtest.crt
+-r--------   1 root     other        887 Nov 22  2005 edirtest_private.key
+
+eklutna.root> which openssl
+/usr/local/bin/openssl
+
+eklutna.root> openssl req -new -key edirprep_private.key -out edirprep.csr 
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+If you enter '.', the field will be left blank.
+-----
+Country Name (2 letter code) [AU]:US
+State or Province Name (full name) [Some-State]:Alaska
+Locality Name (eg, city) []:Fairbanks
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:University of Alaska
+Organizational Unit Name (eg, section) []:Office of Information Technology
+Common Name (eg, YOUR name) []:edirprep.alaska.edu
+Email Address []:sdts@email.alaska.edu
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+
+eklutna.root> ls -altr|tail
+-r--------   1 root     other       1117 Dec 29 11:53 edgar_private.pem
+-r--------   1 root     other        887 Dec 29 11:55 edgar_private.key
+-r--------   1 root     other       1387 Feb  5 15:51 edir_2007.crt
+-r--------   1 root     other       1387 Feb  5 15:51 edir.crt
+-r--------   1 root     other        948 Feb 19 11:33 egegik.crt
+-r--------   1 root     other        944 Feb 19 11:35 eklutna.crt
+-r--------   1 root     other        948 Feb 19 11:53 edgar.crt
+-r-x------   1 root     other         42 Apr  6 16:13 .check-for-CNTL-M.ksh
+-rw-r--r--   1 root     other        773 Apr 12 10:36 edirprep.csr
+dr--------   2 root     other       1536 Apr 12 10:36 .
+
+eklutna.root> cat edirprep.csr
+-----BEGIN CERTIFICATE REQUEST-----
+MIICATCCAWoCAQAwgcAxCzAJBgNVBAYTAlVTMQ8wDQYDVQQIEwZBbGFza2ExEjAQ
+BgNVBAcTCUZhaXJiYW5rczEdMBsGA1UEChMUVW5pdmVyc2l0eSBvZiBBbGFza2Ex
+KTAnBgNVBAsTIE9mZmljZSBvZiBJbmZvcm1hdGlvbiBUZWNobm9sb2d5MRwwGgYD
+VQQDExNlZGlycHJlcC5hbGFza2EuZWR1MSQwIgYJKoZIhvcNAQkBFhVzZHRzQGVt
+YWlsLmFsYXNrYS5lZHUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL4LW2ki
+FlIQiAmOFK3H6la8KiJguI7lwA83dqOCrcDnM50bCBNuVnmNm12y/9C3mzjw8jq+
+P68CDA5S3f2DpH0RgoWgvWGqORItQ/qzw4qSxHCRbrH37F0yUoba5dQyFx0NN2gT
+vGtb/IJwM46GYqPpM/TrwEHER/hdwSelT8ZZAgMBAAGgADANBgkqhkiG9w0BAQQF
+AAOBgQAcqdVz9r3Ot+mlodIfmUAI5ztG625MwlldivzCPDhwIyOwRPLcv16/mhMU
+M50EOHZ1VNM1cMzTWxaGonLrTXuHWC2KawX9cNHNgL1SyGNBieKzGug+z/43OlDM
+BE51zB7Jsgb4kjfMlkffDkOXrXWXJkhZUW87AEZeJ+F0VeGfig==
+-----END CERTIFICATE REQUEST-----
+
+eklutna.root> openssl req -new -key edirtest_private.key -out edirtest.csr 
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+If you enter '.', the field will be left blank.
+-----
+Country Name (2 letter code) [AU]:US
+State or Province Name (full name) [Some-State]:Alaska
+Locality Name (eg, city) []:Fairbanks
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:University of Alaska
+Organizational Unit Name (eg, section) []:Office of Information Technology
+Common Name (eg, YOUR name) []:edirtest.alaska.edu
+Email Address []:sdts@email.alaska.edu
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+
+eklutna.root> ls -altr|tail                                                
+-r--------   1 root     other        887 Dec 29 11:55 edgar_private.key
+-r--------   1 root     other       1387 Feb  5 15:51 edir_2007.crt
+-r--------   1 root     other       1387 Feb  5 15:51 edir.crt
+-r--------   1 root     other        948 Feb 19 11:33 egegik.crt
+-r--------   1 root     other        944 Feb 19 11:35 eklutna.crt
+-r--------   1 root     other        948 Feb 19 11:53 edgar.crt
+-r-x------   1 root     other         42 Apr  6 16:13 .check-for-CNTL-M.ksh
+-rw-r--r--   1 root     other        773 Apr 12 10:36 edirprep.csr
+-rw-r--r--   1 root     other        773 Apr 12 10:40 edirtest.csr
+dr--------   2 root     other       1536 Apr 12 10:40 .
+
+eklutna.root> cat edirtest.csr
+-----BEGIN CERTIFICATE REQUEST-----
+MIICATCCAWoCAQAwgcAxCzAJBgNVBAYTAlVTMQ8wDQYDVQQIEwZBbGFza2ExEjAQ
+BgNVBAcTCUZhaXJiYW5rczEdMBsGA1UEChMUVW5pdmVyc2l0eSBvZiBBbGFza2Ex
+KTAnBgNVBAsTIE9mZmljZSBvZiBJbmZvcm1hdGlvbiBUZWNobm9sb2d5MRwwGgYD
+VQQDExNlZGlydGVzdC5hbGFza2EuZWR1MSQwIgYJKoZIhvcNAQkBFhVzZHRzQGVt
+YWlsLmFsYXNrYS5lZHUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAN9YfD3x
+C5D5VxY+q9TlgWec7+OtON7FxuAc8C8tRidvFHf0SrW724GXy7xcIlmQrZPXccUr
+uCMTSixAjmbOAOWkyHQiAC7p7azWgkmhCZa5W2sXx0pelxfkRE4psvVyUEPgvk43
+1DVERKeRysuBH/hL7Yz0Owd2T0+ZN6XecmwbAgMBAAGgADANBgkqhkiG9w0BAQQF
+AAOBgQCagGaZoIWu5EO4BkqGytWTUTjrC6C2TzZEBXWFOeWRte4vFuPM9ORe0Uic
+6UIQSWD6ftJ7Q0IFj2evdNp8SOClMcPuJwkxHvxyFRTKczBBKipUc5v8YfUqE3fA
+2RFmTy4DcaFpMHlw1AREBS6wTVZuAArtv9xzndjREAEqQPqLZg==
+-----END CERTIFICATE REQUEST-----
+
+eklutna.root> ls -l edir+(prep|test)*
+-r--------   1 root     other       2948 Nov 22  2005 edirprep.crt
+-rw-r--r--   1 root     other        773 Apr 12 10:36 edirprep.csr
+-r--------   1 root     other        891 Nov 22  2005 edirprep_private.key
+-r--------   1 root     other       2948 Nov 22  2005 edirtest.crt
+-rw-r--r--   1 root     other        773 Apr 12 10:40 edirtest.csr
+-r--------   1 root     other        887 Nov 22  2005 edirtest_private.key
+
+eklutna.root> 
+}}}
+