Creating a self signed Apache SSL certificate

Creating a self signed Apache SSL certificate

if you ever need to use HTTPS or SSL with your website, you will need to have an SSL certificate created, which your Apache web server would use to hand out to the web browsers of the site visitors. The certificate is normally generated at the time of Linux installation of your PC/server, during Apache installation. However, this certificate would be created for a machine, named “localhost.localdomain” . When a web browser visits such a site , it sees this certificate, and also sees that it does not match the website's hostname or FQDN. Modern browsers see it as a threat, or something “fishy”. Here is how you would create a new certificate for your website, on your web server. I am using CentOS 5.3 .

Your Apache ssl.conf in /etc/httpd.conf.d directory has the following SSLCertificate related directives.

[root@www conf.d]# grep SSLCertificate /etc/httpd/conf.d/ssl.conf

# Point SSLCertificateFile at a PEM encoded certificate. If

SSLCertificateFile /etc/pki/tls/certs/localhost.crt

SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

# Point SSLCertificateChainFile at a file containing the

# the referenced file can be the same as SSLCertificateFile

#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt

[root@www conf.d]#

Also note down the permissions set of these two files:-

[root@www conf.d]# ls -lh /etc/pki/tls/certs/localhost.crt

-rw------- 1 root root 1.5K May 5 23:02 /etc/pki/tls/certs/localhost.crt

[root@www conf.d]# ls -lh /etc/pki/tls/private/localhost.key

-rw------- 1 root root 891 May 5 23:02 /etc/pki/tls/private/localhost.key

Now create the new certificate files:

[root@www conf.d]# openssl req -new -days 365 -x509 -nodes -out /etc/pki/tls/certs/server.crt -keyout /etc/pki/tls/private/server.key

Generating a 1024 bit RSA private key

......++++++

...................................++++++

writing new private key to '/etc/pki/tls/private/server.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:US

State or Province Name (full name) [Berkshire]:California

Locality Name (eg, city) [Newbury]:Los Angeles

Organization Name (eg, company) [My Company Ltd]:Example Web Site

Organizational Unit Name (eg, section) []:Web

Common Name (eg, your name or your server's hostname) []:www.example.com

Email Address []: webserver@example.com

Note that the files are called server.crt and server.key . You can have any name for these files though. Now you should update your ssl.conf file to use thse files instead of the localhost.crt and localhost.key .

[root@www conf.d]# vi /etc/httpd/conf.d/ssl.conf

...

SSLCertificateFile /etc/pki/tls/certs/server.crt

...

SSLCertificateKeyFile /etc/pki/tls/private/server.key

...

...

Update the permission set of these two files :-

[root@www conf.d]# chmod 0600 /etc/pki/tls/certs/server.crt

[root@www conf.d]# chmod 0600 /etc/pki/tls/private/server.key

[root@www conf.d]# service httpd restart

Stopping httpd: [ OK ]

Starting httpd: [ OK ]

That is all.

Remember, that this is still a self signed certificate. That means browser clients will still see a “this certificate is no good”, type of message before presenting the site. But this does give the viewer a peace of mind. 

Web-email such as SquirrelMail setup as http://www.example.com/webmail, should now be able to work as https://www.example.com/webmail .

Please note that Apache SSL certificates cannot be used with Name based Virtual Hosts.