|
Apache-MOD
SSL
Creating
a Certificate Signing Request
- Install
OpenSSL, if not found on server, and place it in PATH.
- Create
a RSA key for your Apache server by:
cd
to /apacheserverroot/conf/ssl.key directory.(ssl.key is the
default
key directory.) If your have
different setting, cd to your server’s private
key directory
- Type
the following commands to generate a key pair:
$openssl
genrsa -des3 -out server.key 1024
- Create
a backup file!
*Make
a copy of the private key file (server.key) generated in step 3 and store it
in a safe place!* The private key file should begin with -----BEGIN RSA
PRIVATE KEY----- and end in -----END RSA PRIVATE KEY-----. To view the
contents of the private key, use the following command:
$
openssl rsa -noout -text -in server.key
*Note:
If you don´t want to use a PEM passphrase, leave out the "-des3"
switch in step 3 and go directly to step 6.
- Enter
and verify PEM passphrase. The passphrase will be used to install the
server certificate and must be readily available.
Warning:
If you lose the passphrase, you must purchase another certificate.
- Type
the following commands to create a CSR with the server RSA private key
(output will be PEM formatted):
$openssl
req -new -key server.key -out server.csr
*
Note: You will be prompted for your PEM passphrase if you included the
"-des3" switch in step 3.
- When
creating a CSR you must follow these conventions.
Enter
the information to be displayed in the certificate.
The
following characters are not accepted: < > ~ ! @ # $ % ^ * / \ ( )
?.,&
Wildcard certificates must start with *. characters
|
