This post is very outdated, you might want to check a more recent version of it at (Self signed wildcard security certificate for apache or nginx), even though it says WILDCARD in the title, it clearly shows how to make one that is not a wildcard certificate
It may be true that tutorials teaching you how to create and install a self signed security certificvate are everywhere, this one here i put for my own purposes, because i use this one that i wrote as copy and paste instructions for speed. I added things to explain why we are doing everything
Here we will discuss installing a self signed certificate (Acting as your own certificate authorite) …
If you are not sure if what you need is a self signed certificate or a proper secure certificate signed by a certificate authority, you can see the difference here
In this tutorial, we will install a self signed certificate on a debian squeeze machine. Please keep in mind that 1 certificate can be installed per IP address. If you need to install more certificates for more hosts, please have a look here.
We are sssuming you have apache installed, other web servers have different installation instructions, but the generation procedure remains the same
The steps we will take are
A- get the system ready
B- Create a private key
C- Create a certificate signing request from the private key
D- Create a certificate from the certificate signinig request
E- Install the certificate and the private key
F- Decrypt the private key (Optional)
A- get the system ready
1- Install openssl
On my debian system, this is done with the following command, on other systems, the installer may be different
apt-get install openssl ssl-cert
2- Create a directory we can work in
mkdir /etc/apache2/ssl
B- Create a private key
Creating a private key is as simple as
1- Go to our working directory
cd /etc/apache2/ssl
2- To create a private key, Issue the command
openssl genrsa -des3 -out myprivate.key 4096
A password of your choice is requiered (You must enter it twice).
You will then have a private key in the file myprivate.key
This is the encryption key for your private key, and even though this is an encrypted private key file, this key should never be shared with anyone. Since if you do decrypt it in the optional step below, and if it is ever shared with anyone after it is decrypted, they can create a certificate just like the one we are creating and fool a visitor into thinking they are on the correct website (in case of a man in the middle attack for example).
C- Create a certificate signing request from the private key
The certificate signing request is the file we normally give to a certificate authority so that they can create a certificate for us, but in this case, we are the certificate authority (Self signed certificate), we will therefore create a Certificate Signing request and sign it ourselves
1- To create a file containing the Certificate signing request data, all we need to do is issue the following command
openssl req -new -key myprivate.key -out signingrequest.csr
You will now be asked for (Keep your eyes open for the common name since it is the most important)
* Your Pass Phrase, the one you chose for the private key (To create a request from a private key, we need the decrypt and read the private key)
* Country Code (US), State…, CITY, Organisation Name, Organisation Unit
* Common name, and this is the most important, this is either your domain or sub domain, if it is your domain, do not add WWW and enter example.com if it is a sub domain enter subd.example.com
* A Challenge password of your choice
* Enter anything into the optional company name.
We will now have 2 files in the directory, our private key (myprivate.key) and a certificate signing request (signingrequest.csr), we have 2 passwords, the private key’s encryption password and the signing request’s challenge password
D- Create a certificate from the certificate signinig request
openssl x509 -req -days 3650 -in signingrequest.csr -signkey myprivate.key -out mypublic.crt
Now, you will be asked the the Private Key’s pass phrase, the first password, Again to decrypt the private key so we can create a certificate.
We will now have 3 files in the directory, our private key (myprivate.key) and a certificate signing request (signingrequest.csr), and out certificate file (mypublic.crt)
E- Install the certificate and the private key
At this point, we have a public key (mypublic.crt), and a private key (myprivate.key), we can now install those on apache, and start using our certificate.
To install certificate on apache, we must
1- Enable mod ssl on apache, this is done with the command
a2enmod ssl
2- Make sure Apache is listening on the SSL port (443 by default)
On a debian system, you will need to verify the file ….
3- Fix the host’s config file to use the certificates
How this is done depends on how your system defines websites in apache, The easiest way to do this on a debian system is to copy the file mysite from the /etc/apache2/sites_available folder into a file called mysite_ssl (The mysite file could be called anything like polosite.com.cfg), then open the new file for editing, change the Virtual Host Line at the top to <VirtualHost *:443> (You may also change the 8 with your IP address) then scroll down to the end of the new file, and right before the end of the Virtual Host, add the following lines
<VirtualHost *:443>
...................
...................
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/mypublic.crt
SSLCertificateKeyFile /etc/apache2/ssl/myprivate.key
</VirtualHost>
4- Restart apache server
On a debian system, the apache server is restarted with the command
/etc/init.d/apache2 restart
IMPORTANT: Now, when you restart the apache server, you will be asked for the password you chose when you created your private key, the next step below will make apache not ask for a password, but will also create a risk if your unencrypted key should fall into a malicious user’s hands. Worth mentioning that most websites do decrypt the private key, then make sure it is in a directory only root user can access, again, by default your private key is encrypted, decrypting it means you need to take very good care of it.
F- Decrypt the private key (Optional)
openssl rsa -in myprivate.key -out myprivate.key.insecure
mv myprivate.key myprivate.key.secure
mv myprivate.key.insecure myprivate.key
Now, restarting Apache should not ask you for a password
G- Working with browsers
Firefox will allow you to add this certificate to it’s memory, whenever this certificate is presented for this hostname, Your modified Firefox will consider it a valid certificate
