Internal Installing Apache SSL Certs - Revision history

Eumhoefer: Eumhoefer moved page Installing Apache SSL Certs to Internal Installing Apache SSL Certs: Internal Page

2017-07-10T17:20:15Z

Eumhoefer moved page Installing Apache SSL Certs to Internal Installing Apache SSL Certs: Internal Page

← Older revision	Revision as of 17:20, 10 July 2017
(No difference)

Tmosey at 21:13, 4 January 2013

2013-01-04T21:13:20Z

← Older revision		Revision as of 21:13, 4 January 2013
Line 23:		Line 23:
	SSLCertificateChainFile /etc/ssl/sub.class1.server.ca.pem		SSLCertificateChainFile /etc/ssl/sub.class1.server.ca.pem
	SSLCACertificateFile /etc/ssl/ca.pem		SSLCACertificateFile /etc/ssl/ca.pem
	SSLCertificateFile /etc/ssl/certs/~~<common name>~~.crt		SSLCertificateFile /etc/ssl/certs/fqdn.crt
	SSLCertificateKeyFile /etc/ssl/private/~~<common name>~~.key		SSLCertificateKeyFile /etc/ssl/private/fqdn.key
	SetEnvIf User-Agent ".MSIE." nokeepalive ssl-unclean-shutdown		SetEnvIf User-Agent ".MSIE." nokeepalive ssl-unclean-shutdown

Ngh at 20:34, 4 January 2013

2013-01-04T20:34:38Z

← Older revision		Revision as of 20:34, 4 January 2013
Line 32:		Line 32:

	==== Notes ====		==== Notes ====
	Copy the ~~Private~~ key to Password Gorilla		Copy the private key to Password Gorilla

Ngh at 20:34, 4 January 2013

2013-01-04T20:34:28Z

← Older revision		Revision as of 20:34, 4 January 2013
Line 30:		Line 30:

	/etc/init.d/apache2 restart		/etc/init.d/apache2 restart

			==== Notes ====
			Copy the Private key to Password Gorilla

Tmosey at 20:27, 4 January 2013

2013-01-04T20:27:11Z

← Older revision		Revision as of 20:27, 4 January 2013
Line 5:		Line 5:

	wget https://www.startssl.com/certs/ca.pem		wget https://www.startssl.com/certs/ca.pem
	wget https://www.startssl.com/certs/sub.class1.server.ca.pem\		wget https://www.startssl.com/certs/sub.class1.server.ca.pem

	*Generate the request		*Generate the request

Ngh at 20:26, 4 January 2013

2013-01-04T20:26:35Z

← Older revision		Revision as of 20:26, 4 January 2013
Line 1:		Line 1:
	*Load StartSSL trusted login cert into browser (Located on Password Gorilla)		*Load StartSSL trusted login cert into browser (Located on Password Gorilla)

	*Login and choose the certificate wizard (verify domain if required)		*Login and choose the certificate wizard (verify domain if required)

	*Skip automatic cert generation in the wizard		*Skip automatic cert generation in the wizard

	*SSH into the server and run in ''/etc/ssl''		*SSH into the server and run in ''/etc/ssl''

	~~<code>~~		wget https://www.startssl.com/certs/ca.pem
	wget https://www.startssl.com/certs/ca.pem		wget https://www.startssl.com/certs/sub.class1.server.ca.pem\

	wget https://www.startssl.com/certs/sub.class1.server.ca.pem\
	~~</code>~~

	*Generate the request		*Generate the request

	~~<code>~~openssl req -new -newkey rsa:2048 -nodes -keyout fqdn.key -out fqdn.csr~~</code>~~		openssl req -new -newkey rsa:2048 -nodes -keyout fqdn.key -out fqdn.csr

	*Set the server domain name for CN		*Set the server domain name for CN

	*Copy server.csr into StartSSL's Cert Wizard		*Copy server.csr into StartSSL's Cert Wizard

	*Wait for verification (check support mailing list)		*Wait for verification (check support mailing list)

	*Follow the instructions in the email and create ''fqdn.crt''		*Follow the instructions in the email and create ''fqdn.crt''

	*Rename the ''fqdn.key'' and ''fqdn.crt'' to the common name		*Rename the ''fqdn.key'' and ''fqdn.crt'' to the common name

	*Modify /etc/ssl/apache.conf to read like this		*Modify /etc/ssl/apache.conf to read like this

	~~<code>~~		SSLEngine On
	SSLEngine On		SSLProtocol all -SSLv2
			SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
	SSLProtocol all -SSLv2		SSLCertificateChainFile /etc/ssl/sub.class1.server.ca.pem
			SSLCACertificateFile /etc/ssl/ca.pem
	SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM		SSLCertificateFile /etc/ssl/certs/<common name>.crt
			SSLCertificateKeyFile /etc/ssl/private/<common name>.key
	SSLCertificateChainFile /etc/ssl/sub.class1.server.ca.pem		SetEnvIf User-Agent ".MSIE." nokeepalive ssl-unclean-shutdown

	SSLCACertificateFile /etc/ssl/ca.pem

	SSLCertificateFile /etc/ssl/certs/<common name>.crt

	SSLCertificateKeyFile /etc/ssl/private/<common name>.key

	SetEnvIf User-Agent ".MSIE." nokeepalive ssl-unclean-shutdown
	~~</code>~~

	*Restart the apache server daemon		*Restart the apache server daemon

	~~<code>~~/etc/init.d/apache2 restart~~</code>~~		/etc/init.d/apache2 restart

Tmosey: moved User:Tmosey/StartSSL to Installing Apache SSL Certs: Publishing article

2013-01-04T20:23:49Z

moved User:Tmosey/StartSSL to Installing Apache SSL Certs: Publishing article

← Older revision	Revision as of 20:23, 4 January 2013
(No difference)

Tmosey: Formatting

2013-01-04T20:22:23Z

Formatting

← Older revision		Revision as of 20:22, 4 January 2013
Line 7:		Line 7:
	*SSH into the server and run in ''/etc/ssl''		*SSH into the server and run in ''/etc/ssl''

	wget https://www.startssl.com/certs/ca.pem		<code>
	wget https://www.startssl.com/certs/sub.class1.server.ca.pem		wget https://www.startssl.com/certs/ca.pem
	# Generate the request
	openssl req -new -newkey rsa:2048 -nodes -keyout fqdn.key -out fqdn.csr		wget https://www.startssl.com/certs/sub.class1.server.ca.pem\
			</code>

			*Generate the request

			<code>openssl req -new -newkey rsa:2048 -nodes -keyout fqdn.key -out fqdn.csr</code>

	*Set the server domain name for CN		*Set the server domain name for CN
Line 16:		Line 21:
	*Copy server.csr into StartSSL's Cert Wizard		*Copy server.csr into StartSSL's Cert Wizard

	*Wait for verification		*Wait for verification (check support mailing list)

	*Follow the instructions in the email and create ''fqdn.crt''		*Follow the instructions in the email and create ''fqdn.crt''
Line 22:		Line 27:
	*Rename the ''fqdn.key'' and ''fqdn.crt'' to the common name		*Rename the ''fqdn.key'' and ''fqdn.crt'' to the common name

	*Modify ''/etc/ssl/apache.conf'' to read like this		*Modify /etc/ssl/apache.conf to read like this

			<code>
			SSLEngine On

	~~SSLEngine On~~		SSLProtocol all -SSLv2
	SSLProtocol all -SSLv2
	SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM		SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
	SSLCertificateChainFile /etc/ssl/sub.class1.server.ca.pem
	SSLCACertificateFile /etc/ssl/ca.pem		SSLCertificateChainFile /etc/ssl/sub.class1.server.ca.pem
	SSLCertificateFile /etc/ssl/certs/<common name>.crt
	SSLCertificateKeyFile /etc/ssl/private/<common name>.key		SSLCACertificateFile /etc/ssl/ca.pem
	SetEnvIf User-Agent ".MSIE." nokeepalive ssl-unclean-shutdown
			SSLCertificateFile /etc/ssl/certs/<common name>.crt

			SSLCertificateKeyFile /etc/ssl/private/<common name>.key

			SetEnvIf User-Agent ".MSIE." nokeepalive ssl-unclean-shutdown
			</code>

	*Restart the apache server daemon		*Restart the apache server daemon

			<code>/etc/init.d/apache2 restart</code>

Ngh at 20:13, 4 January 2013

2013-01-04T20:13:28Z

← Older revision		Revision as of 20:13, 4 January 2013
Line 5:		Line 5:
	*Skip automatic cert generation in the wizard		*Skip automatic cert generation in the wizard

	*SSH into the server and run in /etc/ssl		*SSH into the server and run in ''/etc/ssl''

	wget https://www.startssl.com/certs/ca.pem		wget https://www.startssl.com/certs/ca.pem

Ngh at 20:13, 4 January 2013

2013-01-04T20:13:09Z

← Older revision		Revision as of 20:13, 4 January 2013
Line 1:		Line 1:
	*Load StartSSL trusted login cert into browser		*Load StartSSL trusted login cert into browser (Located on Password Gorilla)

	*Login and choose the certificate wizard (verify domain if required)		*Login and choose the certificate wizard (verify domain if required)
Line 7:		Line 7:
	*SSH into the server and run in /etc/ssl		*SSH into the server and run in /etc/ssl

	wget https://www.startssl.com/certs/ca.pem		wget https://www.startssl.com/certs/ca.pem
			wget https://www.startssl.com/certs/sub.class1.server.ca.pem
	wget https://www.startssl.com/certs/sub.class1.server.ca.pem		# Generate the request
			openssl req -new -newkey rsa:2048 -nodes -keyout fqdn.key -out fqdn.csr
	openssl req -new -newkey rsa:2048 -nodes -keyout ~~server~~.key -out ~~server~~.csr

	*Set the server domain name for CN		*Set the server domain name for CN
Line 19:		Line 18:
	*Wait for verification		*Wait for verification

	*Follow the instructions in the email and create ~~server~~.crt		*Follow the instructions in the email and create ''fqdn.crt''

	*Rename the server.key and server.crt to the common name

	*Modify /etc/ssl/apache.conf to read like this

	~~SSLEngine On~~

	~~SSLProtocol all -SSLv2~~

	~~SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM~~

	~~SSLCertificateChainFile /etc/ssl/sub.class1.server.ca.pem~~

	~~SSLCACertificateFile /etc/ssl/ca.pem~~

	~~SSLCertificateFile /etc/ssl/certs/<~~common name~~>.crt~~		*Rename the ''fqdn.key'' and ''fqdn.crt'' to the common name

	~~SSLCertificateKeyFile~~ /etc/ssl/~~private/<common name>~~.~~key~~		*Modify ''/etc/ssl/apache.conf'' to read like this

	SetEnvIf User-Agent ".MSIE." nokeepalive ssl-unclean-shutdown		SSLEngine On
			SSLProtocol all -SSLv2
			SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
			SSLCertificateChainFile /etc/ssl/sub.class1.server.ca.pem
			SSLCACertificateFile /etc/ssl/ca.pem
			SSLCertificateFile /etc/ssl/certs/<common name>.crt
			SSLCertificateKeyFile /etc/ssl/private/<common name>.key
			SetEnvIf User-Agent ".MSIE." nokeepalive ssl-unclean-shutdown

	*Restart the apache server daemon		*Restart the apache server daemon