Self-signed SSL certificate

A digital certificate either electronic certificate It is a computer file generated by a certification services entity that associates identity data with a natural person, organization or company, thus confirming its digital identity on the Internet.

However, many times we are interested in generating a self-signed certificate for testing or internal use.

Generate a Private Key

First we create the RSA private key, to do this we execute the following command:

text

openssl genrsa -out redorbita.key 2048

Generate a CSR (Certificate Signing Request)

The CSR file can be used in two ways. Primarily, the CSR will be sent to a certification authority, who will verify the identity of the applicant and issue a signed certificate.

The second option, which we will make, is a self-signed certificate.

Bash

[rokitoh@redorbita~]# openssl genrsa -out redorbitar.key 2048
Country Name (2 letter code) [GB] :SP
State or Province Name (full name) [Berkshire] :Madrid
Locality Name (eg, city) [Newbury] :Madrid
Organization Name (eg, company) [My Company Ltd] :red-orbita
Organizational Unit Name (eg, section) [] :Information Technology
Common Name (eg, your name or your server’s hostname) [] :pre.red-orbita.com
Email Address [] :pre.red-orbita.com at ymail dot com
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Self-signed certificate

Bash

[rokitoh@redorbita~]# openssl x509 -req -days 365 -in redorbita.csr -signkey redorbita.key -out redorbita.crt

Configure certificate in Apache

We copy the generated certificates

Bash

[rokitoh@redorbita~]# cp redorbita.crt /usr/local/apache/conf/

[rokitoh@redorbita~]# cp redorita.key /usr/local/apache/conf/

Configure virtual hosts with SSL enabled

text

SSLEngine on

SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt

SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key

SetEnvIf User-Agent «.*MSIE.*» nokeepalive ssl-unclean-shutdown

CustomLog logs/ssl_request_log \

«%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \»%r\» %b»

Restart Apache

Bash

[rokitoh@redorbita~]# /etc/init.d/httpd restart

Configure certificate in Nginx

We copy the generated certificates

Bash

[rokitoh@redorbita~]# cp redorbita.crt /usr/local/nginx/conf/

[rokitoh@redorbita~]# cp redorita.key /usr/local/nginx/conf/

Configure virtual hosts with SSL enabled

text

ssl on;
ssl_certificate /usr/local/nginx/redorbita.crt;
ssl_certificate_key /usr/local/nginx/redorbita.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
ssl_prefer_server_ciphers on;

Restart Nginx

[rokitoh@redorbita~]# /etc/init.d/nginx restart

All the best.

:wq!

Comments