SSL-self-signed-certificate-creation-and-config - Revision history

Ted: /* REFERENCES */

2018-07-06T15:34:41Z

REFERENCES

Ted at 16:23, 25 September 2017

2017-09-25T16:23:57Z

Ted at 16:23, 25 September 2017

2017-09-25T16:23:23Z

Ted: 2017-09-25 MON - Ted adding overview and references sections, article title, minor clean-ups.

2017-09-25T16:23:08Z

2017-09-25 MON - Ted adding overview and references sections, article title, minor clean-ups.

Ted: /* Certificate Authorities and CertBot */

2017-09-25T16:10:25Z

Certificate Authorities and CertBot

Ted: /* Certificate Authorities and CertBot */

2017-09-25T16:10:08Z

Certificate Authorities and CertBot

Ted: /* Certificate Authorities and CertBot */

2017-08-23T23:59:19Z

Certificate Authorities and CertBot

Ted: 2017-07-25 - Ted adding top-of-article links to search engines and more general pages.

2017-07-25T19:41:03Z

2017-07-25 - Ted adding top-of-article links to search engines and more general pages.

Ted: 2017-07-25 - Ted adding section on certificate authorities and CertBot, a recommended ACME client mentioned at https://letsencrypt.org.

2017-07-25T18:31:05Z

2017-07-25 - Ted adding section on certificate authorities and CertBot, a recommended ACME client mentioned at https://letsencrypt.org.

Ted: 2017-07-24 - On Neela wiki page, Ted putting up first notes of SSL self-signed certificate creation - TMH

2017-07-24T19:39:00Z

2017-07-24 - On Neela wiki page, Ted putting up first notes of SSL self-signed certificate creation - TMH

New page

- 2017-07-20 Thursday -

Ted's first finding of instructions on setting up SSL and configuring Apache2 web server to use this encrypted protocol library:

* https://www.linux.com/learn/creating-self-signed-ssl-certificates-apache-linux

Copy of summary of steps from above instructions on-line:



" 
Here's what we're going to do, in order: 

<ol>
<li> Make sure Apache has SSL enabled. 
<li> Generate a certificate signing request (CSR). 
<li> Generate a self-signed certificate. 
<li> Copy the certificate and keys we've generated. 
<li> Tell Apache about the certificate. 
<li> Modify the VirtualHosts to use the certificate. 
<li> Restart Apache and test. 
</ol>
"



== Note From SSL Config On Generic Server ==

  

STEP 1

<pre>

ted@localhost:~$ sudo a2enmod ssl
Enabling module ssl.
See /usr/share/doc/apache2.2-common/README.Debian.gz on how to configure SSL and create self-signed certificates.
Run '/etc/init.d/apache2 restart' to activate new configuration!
ted@localhost:~$

</pre>

STEP 2

<pre>

ted@localhost:~$ # https://www.linux.com/learn/creating-self-signed-ssl-certificates-apache-linux
ted@localhost:~$ # STEP 2
ted@localhost:~$ sudo openssl req -new > new.ssl.csr
Generating a 1024 bit RSA private key
...........++++++
.................................++++++
writing new private key to 'privkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Verify failure
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Oregon
Locality Name (eg, city) []:Portland
Organization Name (eg, company) [Internet Widgits Pty Ltd]:General Industry
Organizational Unit Name (eg, section) []:Web and CMS
Common Name (eg, YOUR name) []:Ted Havelka
Email Address []:ted@general-industry.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.
ted@localhost:~$

</pre>

Checking for new files . . .

<pre>

ted@localhost:~$ ls -lt
total 60
-rw-r--r-- 1 ted ted 720 2017-07-20 12:22 new.ssl.csr
-rw-r--r-- 1 root root 963 2017-07-20 12:22 privkey.pem
drwxr-xr-x 2 ted ted 4096 2017-05-05 15:08 archive
.
.
.

</pre>

STEP 3

<pre>

ted@localhost:~$ sudo openssl rsa -in privkey.pem -out new.cert.key
Enter pass phrase for privkey.pem:
writing RSA key
ted@localhost:~$

ted@localhost:~$ sudo openssl x509 -in new.ssl.csr -out new.cert.cert -req -signkey new.cert.key -days 365
Signature ok
subject=/C=US/ST=Oregon/L=Portland/O=General Industry/OU=Alta/CN=Ted Havelka/emailAddress=ted@general-industry.com
Getting Private key

ted@localhost:~$ sudo cp new.cert.cert /etc/ssl/certs/server-localhost.crt
[sudo] password for ted:
ted@localhost:~$ sudo cp new.cert.key /etc/ssl/private/server-localhost.key

</pre>

Checking permissions of newly created private key file:

<pre>

ted@localhost:/etc/ssl$ sudo su
# id
uid=0(root) gid=0(root) groups=0(root)
# cd private/
# ls -l
total 8
-rw-r--r-- 1 root root 887 2017-07-20 14:15 server-localhost.key
-rw-r----- 1 root ssl-cert 1679 2011-05-10 08:24 ssl-cert-snakeoil.key
# exit
exit
ted@localhost:/etc/ssl$ ls -l /etc/ssl/certs/server-localhost.crt
-rw-r--r-- 1 root root 993 2017-07-20 14:14 /etc/ssl/certs/server-localhost.crt
ted@localhost:/etc/ssl$

</pre>

<center>
[[#top|top of page]]
</center>

← Older revision		Revision as of 15:34, 6 July 2018
Line 197:		Line 197:

	== REFERENCES ==		== REFERENCES ==
		+
		+	* https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-16-04 . . . Certbot and Letsencrypt tutorial by codingmama

@@ Line 2: / Line 2: @@
 <center>
-SSL Certificates For Websites - Generation and Maintenance
+<b>SSL Certificates For Websites - Generation and Maintenance</b><br />
-Notes of Ted Havelka
+Notes of Ted Havelka<br />
 <i>updated 2017-09-25 MON</i>
 </center>

@@ Line 5: / Line 5: @@
 Notes of Ted Havelka
 <i>updated 2017-09-25 MON</i>
-<center>
+</center>

@@ Line 1: / Line 1: @@
 [https://google.com Google] : [https://neelanurseries.com Neela Nurseries] : [[User:Ted|Ted at Neela Wiki]]
 <!-- comment -->
 - 2017-07-20 Thursday -
@@ Line 171: / Line 191: @@
 *  https://whatsmychaincert.com/

@@ Line 156: / Line 156: @@
 Some initial URLs related to certbot daily, end-user use:
 *  https://certbot.eff.org/
 *  https://certbot.eff.org/#ubuntuxenial-apache
 Invoking certbot to obtain certificate for one sub-domain:
 *  https://community.letsencrypt.org/t/certificate-for-just-a-subdomain/23785/4

← Older revision		Revision as of 23:59, 23 August 2017
Line 156:		Line 156:
	* https://certbot.eff.org/#ubuntuxenial-apache		* https://certbot.eff.org/#ubuntuxenial-apache

		+	Invoking certbot to obtain certificate for one sub-domain:
		+	* https://community.letsencrypt.org/t/certificate-for-just-a-subdomain/23785/4

← Older revision		Revision as of 19:41, 25 July 2017
Line 1:		Line 1:
		+	[https://google.com Google] : [https://neelanurseries.com Neela Nurseries] : [[User:Ted\|Ted at Neela Wiki]]

		+
		+	<!-- comment -->

	- 2017-07-20 Thursday -		- 2017-07-20 Thursday -

← Older revision		Revision as of 18:31, 25 July 2017
Line 146:		Line 146:


		+	<!-- comment -->

		+	== Certificate Authorities and CertBot ==

		+	* https://certbot.eff.org/
		+	* https://certbot.eff.org/#ubuntuxenial-apache
		+
		+
		+
		+	<!-- comment -->

	<center>		<center>