## page was renamed from KnowledgeBase/Server/SimpleApacheCert ## page was renamed from SimpleApacheCert . '''NOTA BENE - WORK IN PROGRESS''' - [[#Inputs_&_Thoughts|Your Inputs & Thoughts]] :-) . '''To Technology [[Technology#Technology_Knowledge_Base| Knowledge Base]]''' - '''To Technology [[Technology/KnowledgeBase| Knowledge Base - Overview]]''' - '''To Technology [[Technology/KnowledgeBase/Server| Knowledge Base - Server Certificate]]''' - This Article you find as well in '''Support''' for '''[[Technology/TechnicalSupport/SysAdmin| System Administrators]]''' ---- = Creating a Simple Apache Certificate = This page describes a basic set-up. For more advanced usages and further reference have a look at the [[http://httpd.apache.org/docs/trunk/ssl/index.html#mod-ssl|mod_ssl documentation]]. If you just want a certificate for a single site Apache server this is probably the simplest way to get a CAcert signed certificate. For the more complicated cases please have a look at ApacheServer and VhostsApache. These instructions should work with Apache 2.x on Unixes and Windows. Probably also on other systems. 1. Once Apache is running with mod_ssl you'll have to register the domain component of your webserver (that is "example.org" for the server "www.example.org") with your CAcert account. To do this go to [[https://www.cacert.org|CAcert homepage]], log in, click "Domains -> Add" and follow the instructions there. If your Domain is shown as "verified" on "Domains -> Show" you can continue and generate a certificate for your server. 1. Get openssl if it is not already installed on your system. If you can't find it somewhere else you can try the [[http://www.openssl.org/related/binaries.html|openssl website]] for a binary version for Windows. 1. Generate a certificate signing request (CSR) using the command: {{{ openssl req -newkey rsa:2048 -subj /CN= -nodes -keyout -out }}} For example {{{openssl req -newkey rsa:2048 -subj /CN=www.example.org -nodes -keyout example_key.pem -out example_csr.pem}}} generates a CSR for the server www.example.org in the file example_csr.pem and stores the corresponding private key unencrypted in the file example_key.pem. 1. Go to [[https://www.cacert.org|CACert]], log in, and select "Server certificates -> New". If a Class 3 certificate is available for you I'd advise you to select a Class 3 certificate. 1. Use Copy/Paste to input your CSR (the content of example_csr.pem in the above example) into the big editor box. Be sure to include the header and footer lines ({{{ -----BEGIN CERTIFICATE REQUEST----- }}} and {{{ -----END CERTIFICATE REQUEST----- }}}) and check that after the paste operation the request has not been truncated. 1. Click on "Send" and your certificate will be generated. That is, if you did not make a mistake. If you made one, read the error message, try to understand what it wants to say to you and try again while skipping the mistake. ;) 1. Use Copy/Paste with your favourite editor to save the certificate to a file (let's call the file example_cert.pem). 1. Move the private key and the certificate to a convenient location. Standard Apache installations provide the directories ssl.key for the private key and ssl.crt for the certificate in the configuration directory. If you want to keep the CSR for later reference (though you probably won't need it anymore) there also is a directory named ssl.csr. 1. If using a Class 3 certificate as proposed you'll need the certificate chain file. This is just the Class 3 root certificate and the Class 1 root certificate in PEM format concatenated. Do it yourself or download it from the [[attachment:CAcert_chain.pem|attachments]]. 1. Store the certificate chain file in the ssl.crt directory and let's call it CAcert_chain.pem for future reference. 1. Now all that remains to be done is to correctly configure Apache's mod_ssl. To use the certificate set the following directives in your SSL-configuration: {{{ SSLCertificateFile /example_cert.pem SSLCertificateKeyFile /example_key.pem SSLCertificateChainFile /CAcert_chain.pem }}} 1. This is it. Restart your Apache and see if it works! <
> ---- == Inputs & Thoughts == . 20091113-[[RogerCPao]] . {{{ #!/bin/sh wget http://www.cacert.org/certs/root.txt wget http://www.cacert.org/certs/class3.txt cat class3.txt root.txt > CAcert_chain.pem }}} ---- . 20091116-[[Martin N Brampton]] /e-mail . {{{ Thanks a lot, I've figured it out now. Half the problem is that my servers are running with WHM/cPanel and it's hard to see through the fancy stuff to the actual Apache configuration. I've now added the CA certificate to ca-bundle.crt and amended the Apache configuration to point to the bundle. I guess there was no CA certification before. Best regards, Martin }}} ---- . YYYYMMDD-YourName . {{{ Text / Your Statements, thoughts and e-mail snippets, Please }}} ---- . YYYYMMDD-YourName . {{{ Text / Your Statements, thoughts and e-mail snippets, Please }}} ---- <
> '''Category''' or '''Categories'''<
> CategoryGuides