Create an SSL Certificate/Old - Revision history

Unknown user: Admin moved page Create an SSL Certificate to Create an SSL Certificate/Old

2020-10-07T19:31:28Z

Admin moved page Create an SSL Certificate to Create an SSL Certificate/Old

← Older revision

Revision as of 19:31, 7 October 2020

Unknown user: /* Signing the Server Certificate */

2020-10-07T19:27:14Z

Signing the Server Certificate

← Older revision		Revision as of 19:27, 7 October 2020
Line 46:		Line 46:
	Once you've created the server certificate, it's time to sign it using the certificate authority power, which we granted ourselves.		Once you've created the server certificate, it's time to sign it using the certificate authority power, which we granted ourselves.

	<~~syntaxhighlight~~>		<pre>
	$ openssl ca -out FOO-cert.pem -infiles FOO-req.pem		$ openssl ca -out FOO-cert.pem -infiles FOO-req.pem
	</~~syntaxhighlight~~>		</pre>

Unknown user: /* Generating the Server Certificate */

2020-10-07T19:27:05Z

Generating the Server Certificate

← Older revision		Revision as of 19:27, 7 October 2020
Line 34:		Line 34:
	The "-nodes" option prevents the pass phase from being required at each reboot.		The "-nodes" option prevents the pass phase from being required at each reboot.

	<~~syntaxhighlight~~>		<pre>
	$ openssl req -new -nodes \		$ openssl req -new -nodes \
	-subj '/CN=mydomain.com/O=Blah blah blah/C=US/ST=State/L=Place/emailAddress=username@somewhere.com' \		-subj '/CN=mydomain.com/O=Blah blah blah/C=US/ST=State/L=Place/emailAddress=username@somewhere.com' \
	-keyout FOO-key.pem -out FOO-req.pem -days 3650		-keyout FOO-key.pem -out FOO-req.pem -days 3650
	</~~syntaxhighlight~~>		</pre>

	Note above that "/0=Blah blah blah" must match the name given in the the origional CA. For example, "/0=blahblahblah." will not work. It must be exact.		Note above that "/0=Blah blah blah" must match the name given in the the origional CA. For example, "/0=blahblahblah." will not work. It must be exact.

Unknown user at 22:10, 26 July 2020

2020-07-26T22:10:02Z

← Older revision		Revision as of 22:10, 26 July 2020
Line 1:		Line 1:
			'''WARNING: These instructions are old, this Digital Ocean tutorial is recommended instead: https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-apache-in-ubuntu-20-04'''

	= Installing =		= Installing =

Line 51:		Line 53:


	[[Category:~~Computers~~]]		[[Category:SSL]]
			[[Category:HTTPS]]
			[[Category:Linux]]
			[[Category:Networking]]

Unknown user: /* Creating a Certificate Authority */

2020-07-26T21:56:25Z

Creating a Certificate Authority

← Older revision		Revision as of 21:56, 26 July 2020
Line 10:		Line 10:

	A signed SSL Certificate means the SSL Certificate is trusted by an authority. This makes it possible to make secure connections between a user and a server.		A signed SSL Certificate means the SSL Certificate is trusted by an authority. This makes it possible to make secure connections between a user and a server.

			To create a self-signed certificate, we will create our OWN certificate authority, and sign our own certificate using that certificate authority.

	To create a new CA:		To create a new CA:

Admin: /* Creating a Certificate Authority */

2015-08-07T07:15:48Z

Creating a Certificate Authority

← Older revision		Revision as of 07:15, 7 August 2015
Line 13:		Line 13:
	To create a new CA:		To create a new CA:

	<~~syntaxhighlight~~>		<pre>
	$ /usr/local/ssl/misc/CA.pl -newca		$ /usr/local/ssl/misc/CA.pl -newca
	</~~syntaxhighglight~~>		</pre>

	If you want to go back and change information about the key (e.g. you wanted to change the number of days it will be valid), you can run:		If you want to go back and change information about the key (e.g. you wanted to change the number of days it will be valid), you can run:

	<~~syntaxhighlight~~>		<pre>
	$ openssl x509 -in demoCA/cacert.pem -days 1024 -out cacert.pem -signkey demoCA/private/cakey.pem		$ openssl x509 -in demoCA/cacert.pem -days 1024 -out cacert.pem -signkey demoCA/private/cakey.pem
	$ cp cacert.pem demoCA		$ cp cacert.pem demoCA
	</~~syntaxhighlight~~>		</pre>



	= Generating the Server Certificate =		= Generating the Server Certificate =

Admin at 21:04, 20 October 2010

2010-10-20T21:04:25Z

← Older revision		Revision as of 21:04, 20 October 2010
Line 52:		Line 52:

	[[Category:Computers]]		[[Category:Computers]]
	~~[[Category:Programs]]~~

Admin at 09:13, 20 October 2010

2010-10-20T09:13:05Z

← Older revision		Revision as of 09:13, 20 October 2010
Line 47:		Line 47:
	$ openssl ca -out FOO-cert.pem -infiles FOO-req.pem		$ openssl ca -out FOO-cert.pem -infiles FOO-req.pem
	</syntaxhighlight>		</syntaxhighlight>




			[[Category:Computers]]
			[[Category:Programs]]

Admin: /* Generating the Server Certificate */

2010-10-20T09:12:34Z

Generating the Server Certificate

← Older revision		Revision as of 09:12, 20 October 2010
Line 36:		Line 36:
	-subj '/CN=mydomain.com/O=Blah blah blah/C=US/ST=State/L=Place/emailAddress=username@somewhere.com' \		-subj '/CN=mydomain.com/O=Blah blah blah/C=US/ST=State/L=Place/emailAddress=username@somewhere.com' \
	-keyout FOO-key.pem -out FOO-req.pem -days 3650		-keyout FOO-key.pem -out FOO-req.pem -days 3650
	</~~syntaxhighglight~~>		</syntaxhighlight>

	Note above that "/0=Blah blah blah" must match the name given in the the origional CA. For example, "/0=blahblahblah." will not work. It must be exact.		Note above that "/0=Blah blah blah" must match the name given in the the origional CA. For example, "/0=blahblahblah." will not work. It must be exact.

Admin: Created page with "= Installing = == Prerequisites == In order to create your own SSL certificate, you'll need OpenSSL installed on your machine. = Creating a Certificate Authority = Typically,..."

2010-10-20T09:12:16Z

Created page with "= Installing = == Prerequisites == In order to create your own SSL certificate, you'll need OpenSSL installed on your machine. = Creating a Certificate Authority = Typically,..."

New page

= Installing =

== Prerequisites ==

In order to create your own SSL certificate, you'll need OpenSSL installed on your machine.

= Creating a Certificate Authority =

Typically, a company will pay hundreds or thousands of dollars to a Certificate Authority, and in return that company's website will be granted an "official" signed SSL Certificate.

A signed SSL Certificate means the SSL Certificate is trusted by an authority. This makes it possible to make secure connections between a user and a server.

To create a new CA:

<syntaxhighlight>
$ /usr/local/ssl/misc/CA.pl -newca
</syntaxhighglight>

If you want to go back and change information about the key (e.g. you wanted to change the number of days it will be valid), you can run:

<syntaxhighlight>
$ openssl x509 -in demoCA/cacert.pem -days 1024 -out cacert.pem -signkey demoCA/private/cakey.pem
$ cp cacert.pem demoCA
</syntaxhighlight>

= Generating the Server Certificate =

This creates a certificate for your server, which is signed by the CA authority (normally someone like Verisign, but in this case YOU).

The "-nodes" option prevents the pass phase from being required at each reboot.

<syntaxhighlight>
$ openssl req -new -nodes \
-subj '/CN=mydomain.com/O=Blah blah blah/C=US/ST=State/L=Place/emailAddress=username@somewhere.com' \
-keyout FOO-key.pem -out FOO-req.pem -days 3650
</syntaxhighglight>

Note above that "/0=Blah blah blah" must match the name given in the the origional CA. For example, "/0=blahblahblah." will not work. It must be exact.

= Signing the Server Certificate =

Once you've created the server certificate, it's time to sign it using the certificate authority power, which we granted ourselves.

<syntaxhighlight>
$ openssl ca -out FOO-cert.pem -infiles FOO-req.pem
</syntaxhighlight>