SSL - Revision history

Michael at 03:14, 1 May 2012

2012-05-01T03:14:27Z

← Older revision		Revision as of 03:14, 1 May 2012
Line 3:		Line 3:

	* [https://www.godaddy.com/ssl/ssl-open-source.aspx godaddy] offers certs for open source projects.		* [https://www.godaddy.com/ssl/ssl-open-source.aspx godaddy] offers certs for open source projects.
			** Only free for the first year.
	* [http://www.startssl.com/ startssl] offers free certs to everyone.		* [http://www.startssl.com/ startssl] offers free certs to everyone.

Michael: Adding certificate request

2011-06-01T09:08:56Z

Adding certificate request

← Older revision		Revision as of 09:08, 1 June 2011
Line 9:		Line 9:
	** You will be prompted for Country, State/Province, Locality, Organization, Organization Unit, Common Name (CN), and Email Address.		** You will be prompted for Country, State/Province, Locality, Organization, Organization Unit, Common Name (CN), and Email Address.
	** Enter the web hosts authority for the CN, as it will be used by users to access your site. (eg. "www.codesrc.com") A FQDN not required - a DNS CNAME should be entered, if this is the normal method of accessing the site. (eg. www.codesrc.com is a CNAME for webhost.codesrc.com).		** Enter the web hosts authority for the CN, as it will be used by users to access your site. (eg. "www.codesrc.com") A FQDN not required - a DNS CNAME should be entered, if this is the normal method of accessing the site. (eg. www.codesrc.com is a CNAME for webhost.codesrc.com).
	** DO NOT enter "YOUR name" into the CN field, as prompted by openssl.		** <strong>DO NOT enter "YOUR name" into the CN field, as prompted by openssl.</strong>
	<pre>		<pre>
	# Change "site" to match your domain. eg. site=codesrc; export site		# Change "site" to match your domain. eg. site=codesrc; export site
Line 57:		Line 57:
	sudo /etc/init.d/apache2 restart		sudo /etc/init.d/apache2 restart
	</pre>		</pre>

			== Creating a certificate request ==
			* You will be prompted for Country, State/Province, Locality, Organization, Organization Unit, Common Name (CN), and Email Address.
			* Enter your business name in the Organization field. If the certificate is not business related, enter your own name.
			* Enter the web hosts authority for the CN, as it will be used by users to access your site. (eg. "www.codesrc.com") A FQDN not required - a DNS CNAME should be entered, if this is the normal method of accessing the site. (eg. www.codesrc.com is a CNAME for webhost.codesrc.com).
			* <strong>DO NOT enter "YOUR name" into the CN field, as prompted by openssl.</strong>

			openssl req -newkey rsa:4096 -out myRequest.csr -text -keyout myPrivateKey.private

			* Provide myRequest.csr to your certificate authority for signing.

Michael at 23:48, 23 May 2011

2011-05-23T23:48:08Z

← Older revision		Revision as of 23:48, 23 May 2011
Line 1:		Line 1:
			== Obtaining a free SSL certificate ==
			The following Certificate Authorities offer free domain-validated certificates that are accepted by the majority of web browsers.

			* [https://www.godaddy.com/ssl/ssl-open-source.aspx godaddy] offers certs for open source projects.
			* [http://www.startssl.com/ startssl] offers free certs to everyone.

	== Creating a self-signed certificate for Apache ==		== Creating a self-signed certificate for Apache ==
	* Create the cert, and copy it to the standard location		* Create the cert, and copy it to the standard location.
			** You will be prompted for Country, State/Province, Locality, Organization, Organization Unit, Common Name (CN), and Email Address.
			** Enter the web hosts authority for the CN, as it will be used by users to access your site. (eg. "www.codesrc.com") A FQDN not required - a DNS CNAME should be entered, if this is the normal method of accessing the site. (eg. www.codesrc.com is a CNAME for webhost.codesrc.com).
			** DO NOT enter "YOUR name" into the CN field, as prompted by openssl.
	<pre>		<pre>
	# Change "site" to match your domain. eg. site=codesrc; export site		# Change "site" to match your domain. eg. site=codesrc; export site

Michael: Created page with "== Creating a self-signed certificate for Apache == * Create the cert, and copy it to the standard location

 # Change "site" to match your domain. eg. site=codesrc; export s…"

2011-05-23T23:33:06Z

Created page with "== Creating a self-signed certificate for Apache == * Create the cert, and copy it to the standard location <pre> # Change "site" to match your domain. eg. site=codesrc; export s…"

New page

== Creating a self-signed certificate for Apache ==
* Create the cert, and copy it to the standard location
<pre>
# Change "site" to match your domain. eg. site=codesrc; export site
cd /tmp
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ${site}-selfsigned.key -outform pem -out ${site}-selfsigned.pem
sudo cp ${site}-selfsigned.pem /etc/ssl/certs/
sudo cp ${site}-selfsigned.key /etc/ssl/private
sudo chgrp ssl-cert /etc/ssl/private/${site}-selfsigned.key
sudo chmod 640 /etc/ssl/private/${site}-selfsigned.key
</pre>

* Modify your apache site config:
<pre>
<IfModule mod_ssl.c>
<VirtualHost *:443>
# Copy standard, non-SSL config here

SSLEngine on
SSLCertificateFile /etc/ssl/certs/codesrc-selfsigned.pem
SSLCertificateKeyFile /etc/ssl/private/codesrc-selfsigned.key
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
</IfModule>

* Make sure mod_ssl is enabled.
<pre>
cd /etc/apache2/sites-enabled
sudo ln -s ../mods-available/ssl.load .
sudo ln -s ../mods-available/ssl.conf .
</pre>

* Restart apache
<pre>
sudo /etc/init.d/apache2 restart
</pre>