View source for SSL-self-signed-certificate-creation-and-config

[https://google.com Google] : [https://neelanurseries.com Neela Nurseries] : [[User:Ted|Ted at Neela Wiki]]

<center>
<b>SSL Certificates For Websites - Generation and Maintenance</b><br />
Notes of Ted Havelka<br />
<i>updated 2017-09-25 MON</i>
</center>


__TOC__




== Overview ==

This article at Neela Nurseries Wiki covers self-signed and Let's Encrypt based SSL certificates for web sites.



<!-- comment -->

== First Efforts ==


- 2017-07-20 Thursday -

Ted's first finding of instructions on setting up SSL and configuring Apache2 web server to use this encrypted protocol library:

*  https://www.linux.com/learn/creating-self-signed-ssl-certificates-apache-linux


Copy of summary of steps from above instructions on-line:

<span style="background: #78abde;">
<p>
"<br />
Here's what we're going to do, in order:<br /> <br />

<ol>
   <li>  Make sure Apache has SSL enabled.<br />
   <li>  Generate a certificate signing request (CSR).<br />
   <li>  Generate a self-signed certificate.<br />
   <li>  Copy the certificate and keys we've generated.<br />
   <li>  Tell Apache about the certificate.<br />
   <li>  Modify the VirtualHosts to use the certificate.<br />
   <li>  Restart Apache and test.<br />
</ol>
"
</p>
</span>


== Note From SSL Config On Generic Server ==

&nbsp;<br />

STEP 1

<pre>

ted@localhost:~$ sudo a2enmod ssl
Enabling module ssl.
See /usr/share/doc/apache2.2-common/README.Debian.gz on how to configure SSL and create self-signed certificates.
Run '/etc/init.d/apache2 restart' to activate new configuration!
ted@localhost:~$

</pre>


STEP 2

<pre>

ted@localhost:~$ # https://www.linux.com/learn/creating-self-signed-ssl-certificates-apache-linux
ted@localhost:~$ # STEP 2
ted@localhost:~$ sudo openssl req -new > new.ssl.csr
Generating a 1024 bit RSA private key
...........++++++
.................................++++++
writing new private key to 'privkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Verify failure
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Oregon
Locality Name (eg, city) []:Portland
Organization Name (eg, company) [Internet Widgits Pty Ltd]:General Industry
Organizational Unit Name (eg, section) []:Web and CMS
Common Name (eg, YOUR name) []:Ted Havelka
Email Address []:ted@general-industry.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.
ted@localhost:~$

</pre>


Checking for new files . . .

<pre>

ted@localhost:~$ ls -lt
total 60
-rw-r--r-- 1 ted  ted    720 2017-07-20 12:22 new.ssl.csr
-rw-r--r-- 1 root root   963 2017-07-20 12:22 privkey.pem
drwxr-xr-x 2 ted  ted   4096 2017-05-05 15:08 archive
   .
   .
   .

</pre>


STEP 3

<pre>

ted@localhost:~$ sudo openssl rsa -in privkey.pem -out new.cert.key
Enter pass phrase for privkey.pem:
writing RSA key
ted@localhost:~$

ted@localhost:~$ sudo openssl x509 -in new.ssl.csr -out new.cert.cert -req -signkey new.cert.key -days 365
Signature ok
subject=/C=US/ST=Oregon/L=Portland/O=General Industry/OU=Alta/CN=Ted Havelka/emailAddress=ted@general-industry.com
Getting Private key

ted@localhost:~$ sudo cp new.cert.cert /etc/ssl/certs/server-localhost.crt
[sudo] password for ted:
ted@localhost:~$ sudo cp new.cert.key /etc/ssl/private/server-localhost.key

</pre>


Checking permissions of newly created private key file:

<pre>

ted@localhost:/etc/ssl$ sudo su
# id
uid=0(root) gid=0(root) groups=0(root)
# cd private/
# ls -l
total 8
-rw-r--r-- 1 root root      887 2017-07-20 14:15 server-localhost.key
-rw-r----- 1 root ssl-cert 1679 2011-05-10 08:24 ssl-cert-snakeoil.key
# exit
exit
ted@localhost:/etc/ssl$ ls -l /etc/ssl/certs/server-localhost.crt
-rw-r--r-- 1 root root 993 2017-07-20 14:14 /etc/ssl/certs/server-localhost.crt
ted@localhost:/etc/ssl$

</pre>



<!-- comment -->

== Certificate Authorities and CertBot ==

Ted's notes here on certbot software.  As of 2017 late September Ted wants to find way to install certbot manually, outside of a Linux type package manager.  Looks like certbot itself is a Python script, so perhaps there is no compilation required on systems where Python interpreter and supporting libraries are already installed . . .

Some initial URLs related to certbot daily, end-user use:

*  https://certbot.eff.org/
*  https://certbot.eff.org/#ubuntuxenial-apache


Invoking certbot to obtain certificate for one sub-domain:

*  https://community.letsencrypt.org/t/certificate-for-just-a-subdomain/23785/4


- 2017-09-25 MON -

Ted researching how to install certbot software from sources, and as yet unsure whether this utility and related need be compiled, or whether they are written in a scripting language.  Related to maintaining SSL type certificates came across mention of chain certificate files:

*  https://whatsmychaincert.com/



<!-- comment -->

== REFERENCES ==



<!-- comment -->

<center>
[[#top|top of page]]
</center>

<!-- OEF -->