This is a summary for getting a properly-signed certificate to use with a web server. Probably the same or similar process for other servers, e.g. LDAP.
- Generate an RSA private key for your server.
- Create a Certficate Signing Request (CSR), specifying the above RSA private key as the key.
- Verify the CSR.
- Send the CSR to a Certificate Authority (CA).
- The CA will send back:
- Your signed SSL certificate, in several files in several formats. Our CA gives these four:
- Certificate with chain, PEM encoded - foobar_example_com.cer
- Certificate only, PEM encoded - foobar_example_com_cert.cer
- Certificate as PKCS#7, PEM encoded - foobar_example_com.crt
- Certificate as PKCS#7 - foobar_example_com.p7b
- An intermediate CA certificate file. This can be thought of as a child of the root CA certificate, which is private and protected by the CA. Our CA gives this file:
- Root/Intermediate(s) only, PEM encoded - foobar_example_com_interm.cer
- Possibly a reverse intermediate CA certificate. I am actually not certain what this is.
In the following, let’s say that the FQDN of your server is foobar.example.com.
On a Red Hat-like system, all the SSL- and TLS-related files/certificates are in the directory tree based at:
/etc/pki/tls/
To generate the RSA private key file foobar.example.com.key:
# cd /etc/pki/tls/private# openssl genpkey -algorithm RSA -out foobar.example.com.key -pkeyopt rsa_keygen_bits:2048
The private key is now in:
/etc/pki/tls/private/foobar.example.com.key
Keep this key private, i.e. root-only access.
Next, create a CSR using that newly-created key, also specifying the FQDN to be associated with the certificate that you are requesting:
# cd /etc/pki/tls/certs
# openssl req -sha512 -new -key /etc/pki/tls/private/foobar.example.com.key -out foobar.example.com.csr
The CSR is the file foobar.example.com.csr.
Verify the CSR:
# openssl req -noout -text -in foobar.example.com.csr
You will get output showing information in the request. Check for the “Subject” line, that it matches your geographical and company information, etc.
Send the CSR to your CA of choice. They will use that CSR to sign a certificate. The signed certificate will be sent to you, along with an intermediate CA certificate, and possibly a reverse intermediate CA certificate.
The CA we use at my organization sends back three files:
- foobar_example_com_cert.cer - the signed certificate
- foobar_example_com_interm.cer - the intermediate CA certificate
- foobar_example_com_interm_reverse.cer - the reverse intermediate CA certificate
For Red Hat-like systems, these files should be put in:
- signed certificate - /etc/pki/tls/certs/foobar_example_com_cert.cer
- intermediate CA certificate - /etc/pki/tls/certs/foobar_example_com_interm.cer
- reverse intermediate CA certificate - /etc/pki/tls/certs/foobar_example_com_interm_reverse.cer
For Apache HTTPD setup, modify the file /etc/httpd/conf.d/ssl.conf
<VirtualHost _default_:443>…SSLCertificateFile /etc/pki/tls/certs/foobar_example_com_cert.cerSSLCertificateChainFile /etc/pki/tls/certs/foobar_example_com_interm.cer…</VirtualHost>
There is one more setting in that VirtualHost section, for the CA certificate bundle: the SSLCACertificateFile. This file is usually provided by a distro package. In the case of RHEL, it is provided by the ca-certificates package. The default value should be:
SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
Sources:
