Mauritius Finance

Sep 30 2017

Create a Self-Signed wildcard SSL CertificateDavid DeMartini actual #apache2,apple,application,cert,how-to,nginx,openssl,ssl,web #server,xcode,xcode #4,software #development,technology


#

Create a Self-Signed wildcard SSL Certificate

Justification

Are you a developer that commonly uses SSL / HTTPS communications on your websites? Do you have multiple development environments hosted on the same domain (such as separate client demo/eval/testing VirtualHosts?), then a wildcarded SSL cert might be for you.

Generating one is very simple process. You will need to have the OpenSSL libraries installed on your computer. All but the worst of Operating systems is likely to have this already installed. If not, you can always go here and get a package: [OpenSSL.org ]

Enough reasoning and rationalization, time to get down to business.

Overview

First you must have a private key generated and installed. Second that key is then used to generate a simultaneous signing request and cert signing operation.

Once you have your files created, reference them in the Webserver of your choice (such as nginX or Apach2, if you are using IIS my heart aches for your plight), using the documentation for that webserver. I m not going to go into there here, because I m just taking the time to share this simple process fore generating the CERT.

Step 1 Generate your private key

If you do not have a private key generated, I m going to show you have to do it. If you have one that you want to use already, and you know where it is, move onto the next step.

Open a termnal window and execute the following openssl command to generate a private key. For my own installations I never use a key shorter than 2048. Most of the time, I use one that is quite a bit longer. That said, 2048 should provide a sufficiently long key for any practical SSL purposes. Yes, SSL has security issues and a motivated hacker can likely piggy-back it, regardless of your key size but for the sake of argument and getting through this post, we ll pretend the Interwebs are a safe place.

Move to the location where you will store your private key (this is a typical location, you can use whatever you want):

cd /etc/ssl/private

Run the command to generate the key:

openssl genrsa 2048 > my.super-awesome.hostname.key

Generating RSA private key, 2048 bit long modulus
. &
. &
e is 65537 (0x10001)

So, now we have a key:

ls -l
-rw-r–r– 1 root wheel 1679 Jan 9 09:41 my.super-awesome.hostname.key

Step 2 Generate your CERT

This is the fun part, and the 2nd of the super easy steps. To complete this you ll want to know up front, some important pieces of data, such as the hostname for your site (I m going to use super-awesome.net for this example). You want to have the address you want to use handy, including the country. Also want to have an e-mail address that will be published in the SSL cert to contact you, and a department and company name if so inclined. Below the actual command and responses will be in bold:

openssl req -new -x509 -nodes -sha1 -days 3650 -key my.super-awesome.hostname.key > my.super-awesome.hostname.cert

Verify that you have the file:

ls -l
-rw-r–r– 1 root wheel 1927 Jan 9 09:50 my.super-awesome.hostname.cert

That s all there is to it! You re done. Now you have a Self-Signed SSL wildcard sert for super-awesome.net. This would allow you to secure (and I always use the word secure with a certain degree of sarcasm) any sub-domain / hostname under super-awesome.net. Examples of what it would handle:

Now, it s important to note that this DOES NOT secure anything beyond that first level. here are a couple more examples:

Extra Credit viewing the contents of your CERT

It s all well and good to generate the cert, but what if you want to verify it s properly setup? What if you find a cert on your system and you want to know what it covers, when it expires, whom might own it, etc. Well, that s possible too. Running a simple command we ll examine the SSL Cert just created. The important info is in the Issuer and Subject blocks.

That’s all there is to it. Now, secure those website communications!

Be Sociable, Share!

Post navigation

Search

Categories

Tag Cloud

Recent Posts

Archives


Written by admin


Leave a Reply

Your email address will not be published. Required fields are marked *