Difference between revisions of "Server:SSL"
From RadonWiki
m (Mcarter moved page SSL-certificate to Server:SSL without leaving a redirect) |
m |
||
| Line 19: | Line 19: | ||
/etc/ssl/certs/RapidSSL.pem | /etc/ssl/certs/RapidSSL.pem | ||
</PRE> | </PRE> | ||
| − | |||
| − | |||
== Renewal Process == | == Renewal Process == | ||
| − | |||
| − | |||
<source lang="sh"> | <source lang="sh"> | ||
openssl genrsa -des3 -out radon.nz.key.withpass 2048 | openssl genrsa -des3 -out radon.nz.key.withpass 2048 | ||
| Line 67: | Line 63: | ||
== Restart Services == | == Restart Services == | ||
| − | |||
Check configuration then restart services including sldap | Check configuration then restart services including sldap | ||
| − | < | + | <source lang="sh"> |
apache2ctl configtest | apache2ctl configtest | ||
service slapd force-reload | service slapd force-reload | ||
service apache2 restart | service apache2 restart | ||
| − | </ | + | </source> |
| + | |||
| + | [[Category:Server]] | ||
Revision as of 15:54, 13 April 2016
SSL certificates are ordered from trustico https://www.trustico.co.nz/renewals/how-to-renew-ssl-certificate.php
Two wild certificates:
*.ticktock.nz (valid until 6th April 2017)
*.radon.nz (valid until 10th May 2017)
Keys are located here
/etc/ssl/private/ticktock.nz.key /etc/ssl/private/radon.nz.key
Certificates located here, include the SSLCertificateChainFile
/etc/ssl/certs/ticktock.nz.pem /etc/ssl/certs/radon.nz.pem /etc/ssl/certs/RapidSSL.pem
Renewal Process
openssl genrsa -des3 -out radon.nz.key.withpass 2048
# need to enter a passphrase
# but then do the following to remove it
openssl rsa -in radon.nz.key.withpass -out radon.nz.key
openssl req -new -key radon.nz.key -out radon.nz.csr
# Country Name (2 letter code) [AU]:NZ
# State or Province Name (full name) [Some-State]:Otago
# Locality Name (eg, city) []:Arrowtown
# Organization Name (eg, company) [Internet Widgits Pty Ltd]:Radon Computing Limited
# Organizational Unit Name (eg, section) []:
# Common Name (e.g. server FQDN or YOUR name) []:*.radon.nz
# Email Address []:
#
# Please enter the following 'extra' attributes
# to be sent with your certificate request
# A challenge password []:
# An optional company name []:
# use radon.nz.csr to renew certificate with trustico
# a resulting "pem" will be provided. save this as radon.nz.pem
# also the certificate chain will be provided. save this as RapidSSL.pem
# move radon.nz.key to /etc/ssl/private/
# move radon.nz.pem to /etc/ssl/certs/
# move RapidSSL.pem to /etc/ssl/certs/
# For radon.nz wild card cert
# run "apache2ctl configtest" to check before restarting apache
SSLEngine on
SSLCertificateFile /etc/ssl/certs/radon.nz.pem
SSLCertificateKeyFile /etc/ssl/private/radon.nz.key
SSLCertificateChainFile /etc/ssl/certs/RapidSSL.pem
Restart Services
Check configuration then restart services including sldap
apache2ctl configtest
service slapd force-reload
service apache2 restart
