Difference between revisions of "Server:SSL"
From RadonWiki
m (→Renewal Process) |
|||
| Line 26: | Line 26: | ||
| − | < | + | <source lang="sh"> |
openssl genrsa -des3 -out radon.nz.key.withpass 2048 | openssl genrsa -des3 -out radon.nz.key.withpass 2048 | ||
# need to enter a passphrase | # need to enter a passphrase | ||
| Line 64: | Line 64: | ||
SSLCertificateChainFile /etc/ssl/certs/RapidSSL.pem | SSLCertificateChainFile /etc/ssl/certs/RapidSSL.pem | ||
| − | </ | + | </source> |
| − | + | ||
== Restart Services == | == Restart Services == | ||
Revision as of 15:19, 13 April 2016
SSL certificates are ordered from trustico https://www.trustico.co.nz/renewals/how-to-renew-ssl-certificate.php
Two wild certificates:
*.ticktock.nz (valid until 6th April 2017)
*.radon.nz (valid until 10th May 2017)
Keys are located here
/etc/ssl/private/ticktock.nz.key /etc/ssl/private/radon.nz.key
Certificates located here, include the SSLCertificateChainFile
/etc/ssl/certs/ticktock.nz.pem /etc/ssl/certs/radon.nz.pem /etc/ssl/certs/RapidSSL.pem
Renewal Process
openssl genrsa -des3 -out radon.nz.key.withpass 2048
# need to enter a passphrase
# but then do the following to remove it
openssl rsa -in radon.nz.key.withpass -out radon.nz.key
openssl req -new -key radon.nz.key -out radon.nz.csr
# Country Name (2 letter code) [AU]:NZ
# State or Province Name (full name) [Some-State]:Otago
# Locality Name (eg, city) []:Arrowtown
# Organization Name (eg, company) [Internet Widgits Pty Ltd]:Radon Computing Limited
# Organizational Unit Name (eg, section) []:
# Common Name (e.g. server FQDN or YOUR name) []:*.radon.nz
# Email Address []:
#
# Please enter the following 'extra' attributes
# to be sent with your certificate request
# A challenge password []:
# An optional company name []:
# use radon.nz.csr to renew certificate with trustico
# a resulting "pem" will be provided. save this as radon.nz.pem
# also the certificate chain will be provided. save this as RapidSSL.pem
# move radon.nz.key to /etc/ssl/private/
# move radon.nz.pem to /etc/ssl/certs/
# move RapidSSL.pem to /etc/ssl/certs/
# For radon.nz wild card cert
# run "apache2ctl configtest" to check before restarting apache
SSLEngine on
SSLCertificateFile /etc/ssl/certs/radon.nz.pem
SSLCertificateKeyFile /etc/ssl/private/radon.nz.key
SSLCertificateChainFile /etc/ssl/certs/RapidSSL.pem
Restart Services
Check configuration then restart services including sldap
apache2ctl configtest service slapd force-reload service apache2 restart
