How to Generate a Self-Signed SSL Certificate on Linux

 In Dedicated, VPS, Web

Step 1: Create an RSA Keypair

The first step is to use the “openssl” package on Linux/CentOS to create an RSA key pair. To do this, make sure that you have the package installed. If not, install it with:

sudo yum install openssl

Chances are that you already have it available on your system. If so, generate the key/pair using the following command:

openssl genrsa -des3 -passout pass:x -out keypair.key 2048

This command uses 2048 bit encryption and outputs a file called “keypair.key” as shown here:

As you can see, the key has been generated and placed in the current directory.

Step 2: Extract the Private Key into an “httpd” Folder

The “/etc/httpd” folder is where the system keeps all the important SSL related stuff. So first, let’s create a new folder to hold all the files relating to our private key:

sudo mkdir /etc/httpd/httpscertificate

I’ve called the folder “httpscertificate” and will refer to it for all the other command line examples.

To extract the private key from the keypair file that we just created, type in the following:

openssl rsa -passin pass:x -in keypair.key -out /etc/httpd/httpscertificate/012.345.678.90.key

Replace the section in bold with the IP address of your own server. Or if you’re able to access your site with a domain name, you can use that as well.

This will create a “key” file in the folder that we just created. And when that’s done, we can delete the original keypair file:

rm keypair.key

Step 3: Creating a “Certificate Signing Request” or CSR File

With the key, we can create a special “csr” file that we can either sign ourselves or submit to a “Certificate Authority”. It’s in a standardized format. To create it, type the following command:

openssl req -new -key /etc/httpd/httpscertificate/012.345.678.90.key -out /etc/httpd/httpscertificate/012.345.678.90.csr

Again, replace the items in bold with the IP address or domain name that you settled on in step 2. When you run this command, the tool will ask you for a bunch of personal information:

A CA can use these details to verify that you are indeed who you say you are. Fill up as much information as you can.

Once you’ve finished entering these details, the tool will wrap up its work and place a “csr” file in the directory we created for just this purpose.

Step 4: Creating the Certificate “.crt” File

With the CSR, we can create the final certificate file as follows:

openssl x509 -req -days 365 -in /etc/httpd/httpscertificate/012.345.678.90.csr -signkey /etc/httpd/httpscertificate/012.345.678.90.key -out /etc/httpd/httpscertificate/012.345.678.90.crt

This creates a “crt” file along with all the others. Here’s a screenshot of the final files in our security folder:

Now we need to tell Apache where these files are.

Step 5: Configuring Apache to Use the Files

First, we need to install the “mod_ssl” package with the command:

sudo yum install mod_ssl

Once done, this will place a “ssl.conf” file inside the /etc/httpd/conf.d/ folder. We need to modify this default file:

sudo vi /etc/httpd/conf.d/ssl.conf

Now scroll down till you find the lines starting with:

SSL CertificateKeyFile

Change the default paths with the paths to the certificate file and key file respectively as shown here:

Save your changes. Now just restart Apache with:

sudo apachectl restart

And you’re done! When Apache restarts, it will be configured to allow SSL connections.

When you connect to your IP address via HTTPS the next time, you’ll be warned that it’s not a trusted certificate:

That’s ok. We know this since we signed it ourselves! Just proceed and it’ll take you to the final site:

Here you can see that it’s using the certificate that we created. It’s not much use for anyone else visiting your site since they can’t verify your identity. But you know it’s safe, and moreover that it’s encrypted. No man in the middle attacks!

Recommended Posts

Start typing and press Enter to search